From 07940a89cad5ecfa21c2d1d8e055941bdb097ef9 Mon Sep 17 00:00:00 2001
From: Shannon Booth <shannon@serenityos.org>
Date: Sat, 17 Aug 2024 04:55:02 +1200
Subject: [PATCH] LibWeb: Handle cases with <template> on the HTML parsing
 stack

This appears to have been a bug in the spec which was later corrected -
so to fix the crash we can simply remove this assertion.

Fixes: #868
---
 .../expected/crash-tests/html-with-only-a-template-tag.txt | 7 +++++++
 .../input/crash-tests/html-with-only-a-template-tag.html   | 2 ++
 Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp       | 4 ++--
 3 files changed, 11 insertions(+), 2 deletions(-)
 create mode 100644 Tests/LibWeb/Layout/expected/crash-tests/html-with-only-a-template-tag.txt
 create mode 100644 Tests/LibWeb/Layout/input/crash-tests/html-with-only-a-template-tag.html
diff --git a/Tests/LibWeb/Layout/expected/crash-tests/html-with-only-a-template-tag.txt b/Tests/LibWeb/Layout/expected/crash-tests/html-with-only-a-template-tag.txt
new file mode 100644
index 00000000000..ac8ed6ccee5
--- /dev/null
+++ b/Tests/LibWeb/Layout/expected/crash-tests/html-with-only-a-template-tag.txt
@@ -0,0 +1,7 @@
+Viewport <#document> at (0,0) content-size 800x600 children: not-inline
+  BlockContainer <html> at (0,0) content-size 800x16 [BFC] children: not-inline
+    BlockContainer <body> at (8,8) content-size 784x0 children: not-inline
+
+ViewportPaintable (Viewport<#document>) [0,0 800x600]
+  PaintableWithLines (BlockContainer<HTML>) [0,0 800x16]
+    PaintableWithLines (BlockContainer<BODY>) [8,8 784x0]
diff --git a/Tests/LibWeb/Layout/input/crash-tests/html-with-only-a-template-tag.html b/Tests/LibWeb/Layout/input/crash-tests/html-with-only-a-template-tag.html
new file mode 100644
index 00000000000..1c2ce3cd2f8
--- /dev/null
+++ b/Tests/LibWeb/Layout/input/crash-tests/html-with-only-a-template-tag.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<template><body>
diff --git a/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp b/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp
index 1940ea3410f..ef50a3f57ab 100644
--- a/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp
@@ -1748,11 +1748,11 @@ void HTMLParser::handle_in_body(HTMLToken& token)
         log_parse_error();
 
         // If the stack of open elements has only one node on it, if the second element on the stack of open elements is not a body element,
-        // or if there is a template element on the stack of open elements, then ignore the token. (fragment case)
+        // or if there is a template element on the stack of open elements, then ignore the token.
+        // (fragment case or there is a template element on the stack)
         if (m_stack_of_open_elements.elements().size() == 1
             || m_stack_of_open_elements.elements().at(1)->local_name() != HTML::TagNames::body
             || m_stack_of_open_elements.contains(HTML::TagNames::template_)) {
-            VERIFY(m_parsing_fragment);
             return;
         }
 
