Avoiding losing tree builder output
Speculative tree building fails when document.write() changes the tree builder state such that the speculative state after the </script> tag no longer holds when all the content inserted by document.write() has been parsed. However, only unusual uses of document.write() cause trouble. Here are the things to avoid:
- Don't write unbalanced trees.
<script>document.write("<div>");</script>is bad.<script>document.write("<div></div>");</script>is OK. - Don't write an unfinished token.
<script>document.write("<div></div");</script>is bad. - Don't finish your writing with a carriage return.
<script>document.write("Hello World!\r");</script>is bad.<script>document.write("Hello World!\n");</script>is OK. - Note that writing balanced tags may cause other tags to be inferred in a way that makes the write unbalanced. E.g.
<script>document.write("<div></div>");</script>inside theheadelement will be interpreted as<script>document.write("</head><body><div></div>");</script>which is unbalanced. - Don't format part of a table.
<table><script>document.write("<tr><td>Hello World!</td></tr>");</script></table>is bad.