99e615846246a19fdb5d01fcea5dce49179dd2ba
braney
  Tue Sep 22 10:52:28 2026 -0700
htmlPage: parse valueless tag attributes such as SELECTED

The attribute name scanner read everything up to the next equals sign, so
<OPTION SELECTED value='any'> became a single attribute named "SELECTED
value".  A lookup for SELECTED then found nothing and the SELECT fell back
to its first option.  The same happened to CHECKED on a checkbox, and to the
src in <script async src=...>.  A name now ends at white space as well, with
a look-ahead so that spaces around the equals sign still work.

This is what put 21 soft errors in every hgNearTest robot run since v495.

refs #38413

diff --git src/lib/tests/input/valuelessAttrs.html src/lib/tests/input/valuelessAttrs.html
new file mode 100644
index 00000000000..4d8c70037bb
--- /dev/null
+++ src/lib/tests/input/valuelessAttrs.html
@@ -0,0 +1,40 @@
+<HTML>
+<HEAD><TITLE>Valueless attribute test</TITLE></HEAD>
+<BODY>
+<FORM ACTION="/cgi-bin/hgNear" NAME="mainForm" METHOD=GET>
+
+<!-- A valueless attribute in front of a valued one.  This is what
+     cgiMakeDropList emits, and what hgNear's any/all menu looks like. -->
+<SELECT NAME="logicFirst">
+<OPTION value='all'>All</OPTION>
+<OPTION SELECTED value='any'>Any</OPTION>
+</SELECT>
+
+<!-- The same menu with the valueless attribute at the end. -->
+<SELECT NAME="logicLast">
+<OPTION value='all'>All</OPTION>
+<OPTION value='any' SELECTED>Any</OPTION>
+</SELECT>
+
+<!-- No VALUE attribute at all, so the option text is the value. -->
+<SELECT NAME="logicNoValue">
+<OPTION>all</OPTION>
+<OPTION SELECTED>any</OPTION>
+</SELECT>
+
+<!-- Spaces on both sides of the equals sign. -->
+<INPUT TYPE = TEXT NAME = 'spaced' VALUE = 'spacedValue'>
+
+<!-- CHECKED in front of the name. -->
+<INPUT TYPE=CHECKBOX CHECKED NAME=boxFirst VALUE=on>
+
+<!-- CHECKED after the name. -->
+<INPUT TYPE=CHECKBOX NAME=boxLast VALUE=on CHECKED>
+
+<!-- A valueless attribute between two valued ones. -->
+<INPUT TYPE=TEXT DISABLED NAME=disabledText VALUE=stillNamed>
+
+<INPUT TYPE=SUBMIT NAME=Submit VALUE=go>
+</FORM>
+</BODY>
+</HTML>