html: Add missing condition to 'in cell' insertion mode, required by spec In section 12.2.6.4.15 of the spec, there is a condition that the current node is a td or th element, which is not implemented. This can lead to a panic when the open elements stack is popped whilst empty, as outlined in golang/go#30600. This commit implements that check. Fixes golang/go#30600 Change-Id: I4837815e2edce21b58a985a100d93d146bf71e24 GitHub-Last-Rev: 79084c5a8481cd2cf8e4df632ffa358c1e41335b GitHub-Pull-Request: golang/net#41 Reviewed-on: https://go-review.googlesource.com/c/net/+/172377 Reviewed-by: Kunpei Sakai <namusyaka@gmail.com> Reviewed-by: Nigel Tao <nigeltao@golang.org> Run-TryBot: Kunpei Sakai <namusyaka@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>

diff --git a/html/parse.go b/html/parse.go
index 2aaf2ff..e0bfc1f 100644
--- a/html/parse.go
+++ b/html/parse.go

@@ -1744,8 +1744,9 @@
 				return true
 			}
 			// Close the cell and reprocess.
-			p.popUntil(tableScope, a.Td, a.Th)
-			p.clearActiveFormattingElements()
+			if p.popUntil(tableScope, a.Td, a.Th) {
+				p.clearActiveFormattingElements()
+			}
 			p.im = inRowIM
 			return false
 		}

diff --git a/html/testdata/go/issue_30600_parse_panics_in_cell_mode.dat b/html/testdata/go/issue_30600_parse_panics_in_cell_mode.dat
new file mode 100644
index 0000000..741f4b1
--- /dev/null
+++ b/html/testdata/go/issue_30600_parse_panics_in_cell_mode.dat

@@ -0,0 +1,12 @@
+#data
+<table><math><th><mo><select></table>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math th>
+|         <math mo>
+|           <select>
+|     <table>

diff --git a/html/testdata/go/issue_30961_error_nested_unknown_tag_types.dat b/html/testdata/go/issue_30961_error_nested_unknown_tag_types.dat
new file mode 100644
index 0000000..e314964
--- /dev/null
+++ b/html/testdata/go/issue_30961_error_nested_unknown_tag_types.dat

@@ -0,0 +1,11 @@
+#data
+<html><head></head><body><tag1><tag2 /><p></p></tag1><div></div></body></html>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <tag1>
+|       <tag2>
+|         <p>
+|     <div>

diff --git a/html/testdata/go/template.dat b/html/testdata/go/template.dat
index 4619337..ceaf022 100644
--- a/html/testdata/go/template.dat
+++ b/html/testdata/go/template.dat

@@ -60,15 +60,3 @@
 |       <math template>
 |         <math mn>
 |           <b>
-
-#data
-<html><head></head><body><tag1><tag2 /><p></p></tag1><div></div></body></html>
-#errors
-#document
-| <html>
-|   <head>
-|   <body>
-|     <tag1>
-|       <tag2>
-|         <p>
-|     <div>