LGTM
http://codereview.appspot.com/159053/diff/1/3 File src/com/google/caja/plugin/bridal.js (right): http://codereview.appspot.com/159053/diff/1/3#newcode413 src/com/google/caja/plugin/bridal.js:413: - In IE[67], you can never change the type of an <button> element. once added, or ever? So we rely on the extended createElement syntax for rendering buttons correctly? http://codereview.appspot.com/159053/diff/1/3#newcode415 src/com/google/caja/plugin/bridal.js:415: throws an exception. We want the silent failure. And the default type is 'submit', right? http://codereview.appspot.com/159053/diff/1/3#newcode421 src/com/google/caja/plugin/bridal.js:421: 3rd argument. setAttributeNode is case-insensitive. wow http://codereview.appspot.com/159053/diff/1/3#newcode424 src/com/google/caja/plugin/bridal.js:424: error. In IE[678] and Opera 10, it fails without an error. Thanks for documenting this so thoroughly. http://codereview.appspot.com/159053/diff/1/3#newcode437 src/com/google/caja/plugin/bridal.js:437: return element.setAttribute(name, value, 0); And this should only be reached on IE6/7, or should fail. http://codereview.appspot.com/159053/diff/1/2 File tests/com/google/caja/plugin/domita_test_untrusted.html (right): http://codereview.appspot.com/159053/diff/1/2#newcode3080 tests/com/google/caja/plugin/domita_test_untrusted.html:3080: pass('testButtonMutation'); Please move the pass outside the try. http://codereview.appspot.com/159053
