This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
Another case Hixie found: <table><tr><td><select><template></template><caption>A</table> In this case, we arrive at the <template> in InSelectInTable mode, but when the <template> pops, it resets the insertion mode and sets it to InSelect. reset insertion mode appropriately probably needs to look further up the stack to see if there is a table context element and then set to InSelectInTable.
This bug has been superseded by edits to the spec during HTMLTemplate integration (IOW, it's already fixed in the spec). Note that blink was updated here: https://src.chromium.org/viewvc/blink?revision=158594&view=revision