From c02f560f73efaf9fff564a581d23b9e08f97b54b Mon Sep 17 00:00:00 2001
From: Andreas Kling <awesomekling@gmail.com>
Date: Thu, 21 Nov 2019 20:18:18 +0100
Subject: [PATCH] LibHTML: Parse <element attribute=value> correctly

We were not committing the attribute at all in this case.
---
 Libraries/LibHTML/Parser/HTMLParser.cpp | 28 +++++++++++++------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/Libraries/LibHTML/Parser/HTMLParser.cpp b/Libraries/LibHTML/Parser/HTMLParser.cpp
index 6ae4895169..ef28a97cc2 100644
--- a/Libraries/LibHTML/Parser/HTMLParser.cpp
+++ b/Libraries/LibHTML/Parser/HTMLParser.cpp
@@ -281,6 +281,21 @@ static bool parse_html_document(const StringView& html, Document& document, Pare
                 move_to_state(State::InAttributeList);
                 break;
             }
+            move_to_state(State::InAttributeValueNoQuote);
+            [[fallthrough]];
+        case State::InAttributeValueNoQuote:
+            if (isspace(ch)) {
+                commit_attribute();
+                move_to_state(State::InAttributeList);
+                break;
+            }
+            if (ch == '>') {
+                commit_attribute();
+                commit_tag();
+                move_to_state(State::Free);
+                break;
+            }
+            attribute_value_buffer.append(ch);
             break;
         case State::InAttributeValueSingleQuote:
             if (ch == '\'') {
@@ -298,19 +313,6 @@ static bool parse_html_document(const StringView& html, Document& document, Pare
             }
             attribute_value_buffer.append(ch);
             break;
-        case State::InAttributeValueNoQuote:
-            if (isspace(ch)) {
-                commit_attribute();
-                move_to_state(State::InAttributeList);
-                break;
-            }
-            if (ch == '>') {
-                commit_tag();
-                move_to_state(State::Free);
-                break;
-            }
-            attribute_value_buffer.append(ch);
-            break;
         default:
             fprintf(stderr, "Unhandled state %d\n", (int)state);
             ASSERT_NOT_REACHED();