HTML parser should not insert nodes the DOM would reject - #69748

e8b1d6b

HTML parser should not insert nodes the DOM would reject
https://bugs.webkit.org/show_bug.cgi?id=319780
rdar://183256491

Reviewed by Ryosuke Niwa.

The parser inserts nodes with low-level operations that skip pre-insertion validity
checks, so script that moves a node on the stack of open elements during parsing
could make us build a tree the DOM does not allow.

Use Document::canAcceptChild() when inserting into a Document, which drops Text
node children, a second element child, and a second or misordered DocumentType
child on the floor. This is reachable by foster parenting into a table that script
has made another Document's document element, and by document.open() leaving
children in the Document before the DOCTYPE token or the "html" start tag.

The adoption agency algorithm checked for cycles with Node::contains(), which only
considers the node's own tree, so it missed a parent script had moved into a shadow
root (crashing) or into a template element's content (silently creating an invalid
tree).

Move the nextChild check out of executeInsertAlreadyParsedChildTask() and into
insert(), where nextChild is used. Script can run before a queued insertion takes
place: in the case from bug 169222, parserRemoveChild() destroys an iframe
element's frame and its unload handler removes nextChild from the parent, which is
covered by fast/parser/scriptexec-during-parserInsertBefore.html. Nothing about
that is specific to the adoption agency, though no input is known to reach the
check through a plain insertion.

Because the template element branch runs first and clears nextChild, a stale
nextChild no longer prevents an insertion into a template element's contents. That
is what appropriate place for inserting a node calls for, as it redirects into the
contents after the last child, discarding the reference node.

Spec changes: whatwg/html#12708
              whatwg/html#12709

Tests: imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html
       imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html
       imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html?file=scripted_foster01
       imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html?file=scripted_foster01
       imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html?file=scripted_foster01
       imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html
       imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html
       imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html

Canonical link: https://commits.webkit.org/319453@main

72bdea2

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	❌ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	🧪 win-tests	🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk3-gcc
	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-AS-debug-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-wk2-stress	✅ 🧪 gtk-wk2
✅ 🛠 🧪 merge	✅ 🛠 vision-sim	✅ 🧪 mac-intel-wk2	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🛠 mac-safer-cpp	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🧪 mac-site-isolation
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim