Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e8b1d6b3bee17692f749f06aa2729107a2e3148d
https://github.com/WebKit/WebKit/commit/e8b1d6b3bee17692f749f06aa2729107a2e3148d
Author: Anne van Kesteren <[email protected]>
Date: 2026-08-19 (Wed, 19 Aug 2026)
Changed paths:
M
LayoutTests/fast/parser/append-child-followed-by-document-write-expected.txt
M LayoutTests/fast/parser/append-child-followed-by-document-write.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-cycle-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-cycle.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-inner-loop-cycle-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-inner-loop-cycle.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-pagehide.tentative-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-pagehide.tentative.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url_file=scripted_foster01-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_file=scripted_foster01-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single_file=scripted_foster01-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/resources/adoption-agency-reparenting.js
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/resources/scripted_foster01.dat
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/resources/w3c-import.log
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/w3c-import.log
M Source/WebCore/dom/ContainerNode.cpp
M Source/WebCore/dom/ContainerNode.h
M Source/WebCore/html/parser/HTMLConstructionSite.cpp
Log Message:
-----------
HTML parser should not insert nodes the DOM would reject
https://bugs.webkit.org/show_bug.cgi?id=319780
rdar://183256491
Reviewed by Ryosuke Niwa.
The parser inserts nodes with low-level operations that skip pre-insertion
validity
checks, so script that moves a node on the stack of open elements during parsing
could make us build a tree the DOM does not allow.
Use Document::canAcceptChild() when inserting into a Document, which drops Text
node children, a second element child, and a second or misordered DocumentType
child on the floor. This is reachable by foster parenting into a table that
script
has made another Document's document element, and by document.open() leaving
children in the Document before the DOCTYPE token or the "html" start tag.
The adoption agency algorithm checked for cycles with Node::contains(), which
only
considers the node's own tree, so it missed a parent script had moved into a
shadow
root (crashing) or into a template element's content (silently creating an
invalid
tree).
Move the nextChild check out of executeInsertAlreadyParsedChildTask() and into
insert(), where nextChild is used. Script can run before a queued insertion
takes
place: in the case from bug 169222, parserRemoveChild() destroys an iframe
element's frame and its unload handler removes nextChild from the parent, which
is
covered by fast/parser/scriptexec-during-parserInsertBefore.html. Nothing about
that is specific to the adoption agency, though no input is known to reach the
check through a plain insertion.
Because the template element branch runs first and clears nextChild, a stale
nextChild no longer prevents an insertion into a template element's contents.
That
is what appropriate place for inserting a node calls for, as it redirects into
the
contents after the last child, discarding the reference node.
Spec changes: https://github.com/whatwg/html/pull/12708
https://github.com/whatwg/html/pull/12709
Tests:
imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html
imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html
imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html?file=scripted_foster01
imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html?file=scripted_foster01
imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html?file=scripted_foster01
imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html
imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html
imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html
Canonical link: https://commits.webkit.org/319453@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
