563921 - innerHTML bug to <form> tag

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[fffanz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3

description:
</form> bug disable the <submit> button
can i report bug by the below format?

var html = node.innerHTML 
return:
//bug is: ... <form ...></form><input...><input...><input...type=submit> 
you see the <form ...></form> is error, this error not exist in IE.
innerHTML bug exist in firefox from the latest version, to old versions.i've tested.
And i've tested to many sites, it's a true bug. not only the site i reported.

for example:
var html = document.body.innerHTML;
/*
 [native code]
return newhtml;
*/
 document.body.innerHTML = newhtml;

at last, <form> not work;
click <submit> not work, visitor cannot submit anything.
a big bug.


for simple, the bug is that:

var html = document.body.innerHTML;
 document.body.innerHTML = html;

//<form> not work ??? 
// yes!



//------------------to show bug quick-------------------
	var doc=document.body||document.documentElement;
	var h=doc.innerHTML; 	
	var idx  = -1;
     while( (idx  = h.indexOf('<form'))>0 )
     {
	var str = h.substr(idx)
	      h = str.substr(10);
	 	 alert(str)
     }

//-----------------i have to fix bug when using innerHTML------------------
function fix_firefox_bug_innerHTML_form(html){
	if(!html)return '';
	var bugform=/<form[^>]*?>\s*<\/form>/ig;
	var fixbutton=/(<input[^>]*type\=.?submit[^>]*>)/ig;
	if(bugform.test(html)){
	    return html.replace(/<\/form>/ig).replace(fixbutton,'$1</form>');
	}
	return html;
}

//-----------------------------------------------------------
best & wishes
firefox is beautiful
Thank you to all of Mozilla dev

Reproducible: Always

Steps to Reproduce:
1.this is a copy message from the details
//------------------to show bug quick-------------------
	var doc=document.body||document.documentElement;
	var h=doc.innerHTML; 	
	var idx  = -1;
     while( (idx  = h.indexOf('<form'))>0 )
     {
	var str = h.substr(idx)
	      h = str.substr(10);
	 	 alert(str)
     }

Actual Results:  
at last, <form> not work;
click <submit> not work, visitor cannot submit anything.
sorry, but it's a big bug.

Expected Results:  
innerHTML can return correct htmlcode of <form>

Thank you to all Mozilla dev

Comment 1

[fffanz]

Thank you to all Mozilla dev

Comment 2

[Mats Palmgren (inactive)]

The markup at the URL is:
<table><form><tr><td><input type="submit"></td></tr></form></table>
which is invalid markup when parsed as HTML.

We handle the error by auto-closing the <form> before the <tr> as the
HTML5 spec says:
http://www.whatwg.org/specs/web-apps/current-work/#parsing-main-intable
so the innerHTML result you get is correct.

However, we also have code to "fix" broken pages like this so that
the submit button above should work -- but, if you take the result
of innerHTML and insert it into the document it will not work
because of the auto-inserted </form>.

I think bug 545997 is about the same thing.
(it's the same behavior with the HTML5 parser and old parser AFAICT)

Comment 3

[Henri Sivonen (:hsivonen)]

The form pointer magic explicitly doesn't work in the innerHTML case:
"When a form-associated element's ancestor chain changes, e.g. because it or one of its ancestors was inserted or removed from a Document, then the user agent must reset the form owner of that element."
http://www.whatwg.org/specs/web-apps/current-work/#association-of-controls-and-forms

Conceptually, innerHTML setter inserts a DocumentFragment (although smaug optimized the actual DocumentFragment away).

Marking INVALID. 

Reporter, does this break a real-world site that you use but isn't maintained by you?