html: Add missing condition to 'in cell' insertion mode, required by spec
In section 12.2.6.4.15 of the spec, there is a condition that the current node is a td or th element, which is not implemented. This can lead to a panic when the open elements stack is popped whilst empty, as outlined in golang/go#30600. This commit implements that check.
Fixes golang/go#30600
Change-Id: I4837815e2edce21b58a985a100d93d146bf71e24
GitHub-Last-Rev: 79084c5a8481cd2cf8e4df632ffa358c1e41335b
GitHub-Pull-Request: golang/net#41
Reviewed-on: https://go-review.googlesource.com/c/net/+/172377
Reviewed-by: Kunpei Sakai <namusyaka@gmail.com>
Reviewed-by: Nigel Tao <nigeltao@golang.org>
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
diff --git a/html/parse.go b/html/parse.go
index 2aaf2ff..e0bfc1f 100644
--- a/html/parse.go
+++ b/html/parse.go
@@ -1744,8 +1744,9 @@
return true
}
// Close the cell and reprocess.
- p.popUntil(tableScope, a.Td, a.Th)
- p.clearActiveFormattingElements()
+ if p.popUntil(tableScope, a.Td, a.Th) {
+ p.clearActiveFormattingElements()
+ }
p.im = inRowIM
return false
}
diff --git a/html/testdata/go/issue_30600_parse_panics_in_cell_mode.dat b/html/testdata/go/issue_30600_parse_panics_in_cell_mode.dat
new file mode 100644
index 0000000..741f4b1
--- /dev/null
+++ b/html/testdata/go/issue_30600_parse_panics_in_cell_mode.dat
@@ -0,0 +1,12 @@
+#data
+<table><math><th><mo><select></table>
+#errors
+#document
+| <html>
+| <head>
+| <body>
+| <math math>
+| <math th>
+| <math mo>
+| <select>
+| <table>
diff --git a/html/testdata/go/issue_30961_error_nested_unknown_tag_types.dat b/html/testdata/go/issue_30961_error_nested_unknown_tag_types.dat
new file mode 100644
index 0000000..e314964
--- /dev/null
+++ b/html/testdata/go/issue_30961_error_nested_unknown_tag_types.dat
@@ -0,0 +1,11 @@
+#data
+<html><head></head><body><tag1><tag2 /><p></p></tag1><div></div></body></html>
+#errors
+#document
+| <html>
+| <head>
+| <body>
+| <tag1>
+| <tag2>
+| <p>
+| <div>
diff --git a/html/testdata/go/template.dat b/html/testdata/go/template.dat
index 4619337..ceaf022 100644
--- a/html/testdata/go/template.dat
+++ b/html/testdata/go/template.dat
@@ -60,15 +60,3 @@
| <math template>
| <math mn>
| <b>
-
-#data
-<html><head></head><body><tag1><tag2 /><p></p></tag1><div></div></body></html>
-#errors
-#document
-| <html>
-| <head>
-| <body>
-| <tag1>
-| <tag2>
-| <p>
-| <div>
