Parser fails in IE(8) when trying to deal with invalidly nested HTML

[timmolendijk]

HTML like the following is obviously invalid, but unfortunately IE has a tendency of creating stuff like this (especially when pasting from external editors):

<ul>
  <li>hey<font>!!!</li>
  <li>hit me baby one more time</li>
</ul></font>

If you clean_node the ul in IE(8), the parser not only has a problem with dealing with this scenario, it makes it worse. After sanitization, the HTML (with only ul and li as allowed elements) will look like this:

<UL>
<LI>hey!!!
<LI>hit me baby one more time</LI></LI>
<LI>hit me baby one more time</LI></UL>

Note that this problem only arises in IE8 (and perhaps older versions as well, but that doesn't interest me -- IE9 I haven't tested). So, the exact same process in WebKit or Gecko gives the following HTML, as expected:

<ul>
  <li>hey!!!</li>
  <li>hit me baby one more time</li>
</ul>