Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3dff3fac8c47236b7cab34e2f9239ef83f7f2df9
https://github.com/WebKit/WebKit/commit/3dff3fac8c47236b7cab34e2f9239ef83f7f2df9
Author: Anne van Kesteren <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-content-hierarcy-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-content-hierarcy.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-shadow-cycle-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-shadow-cycle.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-template-cycle-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-template-cycle.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting.html
M Source/WebCore/dom/ContainerNode.cpp
M Source/WebCore/html/parser/HTMLConstructionSite.cpp
Log Message:
-----------
HTML parser should not insert an element into its own subtree
https://bugs.webkit.org/show_bug.cgi?id=322403
Reviewed by Ryosuke Niwa.
Unfortunately the changes in 319453@main were insufficient due to custom
elements.
The constructor cannot append the parent to the element, since creating an
element
rejects a constructed element that has children, but it can move the parent
into a
shadow root, or into the contents of a template element inside one. Check for
that
with containsIncludingHostElements() and drop the element on the floor, as the
adoption agency already does.
Make containsIncludingHostElements() consult the cached shadow-including root to
skip over a tree that cannot contain possibleAncestor, so the ancestor walk is
avoided entirely when the two nodes are in different trees. That is the common
case both for parser insertion and for appending a newly created node from
script.
The cycle check in executeInsertAlreadyParsedChildTask() is now redundant with
the one in insert(). Its parentNode() check is not: script run by
parserRemoveChild() can give the node a parent again without creating a cycle.
Spec changes: https://github.com/whatwg/html/pull/12830
Tests:
imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-shadow-cycle.html
imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-template-cycle.html
imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting.html
Tests upstream: https://github.com/web-platform-tests/wpt/pull/62174
Canonical link: https://commits.webkit.org/319844@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
