Clarify when a parser-inserted element is dropped on the floor - #12708
Merged
Conversation
zcorpan
approved these changes
Aug 17, 2026
Contributor
|
It's quite complex but I believe this doesn't cover all the cases. I think that there could be cases of "If it is not possible to insert..." where you have a The following creates a circular failure: <div id="common-ancestor">
<b id="formatting-element">
<p id="furthest-block">
<iframe id="trap-frame"></iframe>
<script>
let frame = document.getElementById('trap-frame');
frame.contentWindow.onpagehide = () => {
const ca = document.getElementById('common-ancestor');
const fb = document.getElementById('furthest-block');
fb.remove();
fb.appendChild(ca);
};
</script>
</b>
</p>https://software.hixie.ch/utilities/js/live-dom-viewer/?saved=14827 |
annevk
added a commit
to annevk/WebKit
that referenced
this pull request
Aug 18, 2026
https://bugs.webkit.org/show_bug.cgi?id=319780 Reviewed by NOBODY (OOPS!). The parser inserts nodes with low-level operations that skip pre-insertion validity checks, so script that moves a node on the stack of open elements during parsing could make us build a tree the DOM does not allow. Use Document::canAcceptChild() when inserting into a Document, which drops Text node children, a second element child, and a second or misordered DocumentType child on the floor. This is reachable by foster parenting into a table that script has made another Document's document element, and by document.open() leaving children in the Document before the DOCTYPE token or the "html" start tag. The adoption agency algorithm checked for cycles with Node::contains(), which only considers the node's own tree, so it missed a parent script had moved into a shadow root (crashing) or into a template element's content (silently creating an invalid tree). Move the nextChild check out of executeInsertAlreadyParsedChildTask() and into insert(), where nextChild is used. Script can run before a queued insertion takes place: in the case from bug 169222, parserRemoveChild() destroys an iframe element's frame and its unload handler removes nextChild from the parent, which is covered by fast/parser/scriptexec-during-parserInsertBefore.html. Nothing about that is specific to the adoption agency, though no input is known to reach the check through a plain insertion. Because the template element branch runs first and clears nextChild, a stale nextChild no longer prevents an insertion into a template element's contents. That is what appropriate place for inserting a node calls for, as it redirects into the contents after the last child, discarding the reference node. Spec changes: whatwg/html#12708 whatwg/html#12709 Tests: imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html
annevk
added a commit
to annevk/WebKit
that referenced
this pull request
Aug 19, 2026
https://bugs.webkit.org/show_bug.cgi?id=319780 rdar://183256491 Reviewed by NOBODY (OOPS!). The parser inserts nodes with low-level operations that skip pre-insertion validity checks, so script that moves a node on the stack of open elements during parsing could make us build a tree the DOM does not allow. Use Document::canAcceptChild() when inserting into a Document, which drops Text node children, a second element child, and a second or misordered DocumentType child on the floor. This is reachable by foster parenting into a table that script has made another Document's document element, and by document.open() leaving children in the Document before the DOCTYPE token or the "html" start tag. The adoption agency algorithm checked for cycles with Node::contains(), which only considers the node's own tree, so it missed a parent script had moved into a shadow root (crashing) or into a template element's content (silently creating an invalid tree). Move the nextChild check out of executeInsertAlreadyParsedChildTask() and into insert(), where nextChild is used. Script can run before a queued insertion takes place: in the case from bug 169222, parserRemoveChild() destroys an iframe element's frame and its unload handler removes nextChild from the parent, which is covered by fast/parser/scriptexec-during-parserInsertBefore.html. Nothing about that is specific to the adoption agency, though no input is known to reach the check through a plain insertion. Because the template element branch runs first and clears nextChild, a stale nextChild no longer prevents an insertion into a template element's contents. That is what appropriate place for inserting a node calls for, as it redirects into the contents after the last child, discarding the reference node. Spec changes: whatwg/html#12708 whatwg/html#12709 Tests: imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html
annevk
added a commit
to web-platform-tests/wpt
that referenced
this pull request
Aug 19, 2026
document.open() empties the Document and returns the parser to the "initial" insertion mode, so script can add children before the next document.write(). The DOCTYPE token and the "html" start tag then append directly to the Document, which the DOM does not allow when it already has a doctype child or an element child, so those nodes have to be dropped on the floor. See whatwg/html#12708 for context.
webkit-commit-queue
pushed a commit
to annevk/WebKit
that referenced
this pull request
Aug 19, 2026
https://bugs.webkit.org/show_bug.cgi?id=319780 rdar://183256491 Reviewed by Ryosuke Niwa. The parser inserts nodes with low-level operations that skip pre-insertion validity checks, so script that moves a node on the stack of open elements during parsing could make us build a tree the DOM does not allow. Use Document::canAcceptChild() when inserting into a Document, which drops Text node children, a second element child, and a second or misordered DocumentType child on the floor. This is reachable by foster parenting into a table that script has made another Document's document element, and by document.open() leaving children in the Document before the DOCTYPE token or the "html" start tag. The adoption agency algorithm checked for cycles with Node::contains(), which only considers the node's own tree, so it missed a parent script had moved into a shadow root (crashing) or into a template element's content (silently creating an invalid tree). Move the nextChild check out of executeInsertAlreadyParsedChildTask() and into insert(), where nextChild is used. Script can run before a queued insertion takes place: in the case from bug 169222, parserRemoveChild() destroys an iframe element's frame and its unload handler removes nextChild from the parent, which is covered by fast/parser/scriptexec-during-parserInsertBefore.html. Nothing about that is specific to the adoption agency, though no input is known to reach the check through a plain insertion. Because the template element branch runs first and clears nextChild, a stale nextChild no longer prevents an insertion into a template element's contents. That is what appropriate place for inserting a node calls for, as it redirects into the contents after the last child, discarding the reference node. Spec changes: whatwg/html#12708 whatwg/html#12709 Tests: imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html?file=scripted_foster01 imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html Canonical link: https://commits.webkit.org/319453@main
"Insert an element at the adjusted insertion location" previously aborted when it was "not possible to insert" the element, without defining what that meant. Replace it with an explicit condition — the adjusted insertion location is in a Document that already has an element child — mirroring the analogous check in "insert a character", and assert that the insertion then satisfies the DOM's "ensure pre-insert validity". Tests: web-platform-tests/wpt#61396 See #1706.
annevk
force-pushed
the
clarify-drop-element-into-document
branch
from
August 20, 2026 08:23
4b5307d to
ac66b72
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clarify when a parser-inserted element is dropped on the floor
"Insert an element at the adjusted insertion location" previously aborted when
it was "not possible to insert" the element, without defining what that meant.
Replace it with an explicit condition — the adjusted insertion location is in a
Document that already has an element child — mirroring the analogous check in
"insert a character", and assert that the insertion then satisfies the DOM's
"ensure pre-insert validity".
Tests: web-platform-tests/wpt#61396
See #1706.
(See WHATWG Working Mode: Changes for more details.)
/infrastructure.html ( diff )
/parsing.html ( diff )