58942 - swanky.org renders incorrectly

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[Dan Rosen]

either we miscalculate tables, or both nav4 and ie have a quirk which allows
incorrect html tables to work... i'll try to come up with a simple testcase to
demonstrate this, since the swanky.org source is kind of messy.

swanky.org, by the way, used to be cool, for those who are wondering why i'm
filing a bug on a site filled with angsty pubescent short fiction... perhaps i
should file a separate rfe to filter angsty writing in mozilla...

Comment 1

[Cyril Bortolato]

Confirmed with 11/02 build on Linux

Comment 2

[Dan Rosen]

found the problem:

in the page, there is:

<table ...>
  <tr>
    <map name="..."> ... </map>
    <td> ... </td>
  </tr>
</table>

i doubt the inclusion of <map> as content of <tr> is valid html, but it isn't a
display element, and it works fine on 4.x browsers and ie5.x. i have no idea of
the complexity of the fix, so it's up to y'all html people :)

Comment 3

[Hixie (not reading bugmail)]

dr: <map> actually is a display element in HTML4 (it can contain %flow).

We need to check to see if it is a content model problem or a tables problem --
tables should be able to cope with this (by generating an anonymous cell around 
the <map>) but the parser should in any case not be letting <map> be a child of 
<tr>... This might have to go -> Parser.

Comment 4

[Dan Rosen]

setting component to parser, reassigning to default owner.

we probably don't want to generate an anonymous anything as a workaround, if we
can fix this the right way. i have a feeling it'll be a one-line fix to parser,
anyway...

Comment 5

[rickg]

<map> is not a legal child of <TR>, but our bug is likely in 
HandleSavedTokens().

Comment 6

[harishd]

In CNavDTD, MAP seems to be a legal child (!) of TR and therefore
HandleSavedTokens() does not even get triggered. That is, the bug seems to be
either in nsElementTable or in the TABLE code ( since it cannot handle MAP
inside TR ). The best fix would be in the element table ( in htmlparser ) but
have to make sure why, in the first place, MAP is considered to be a legal
child of TR in the DTD.

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

r=heikki for the fix harishd showed me. Please add the fix here as well.

Comment 8

[harishd]

Attachment: proposed patch v1.1

Comment 9

[harishd]

Fix is in. Marking FIXED.

Comment 10

[bsharma]

updated qa contact.

Comment 11

[Dan Rosen]

verified.