Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f5e2e9f7b9b48ddbce2b32173e4fb2f92614d526
https://github.com/WebKit/WebKit/commit/f5e2e9f7b9b48ddbce2b32173e4fb2f92614d526
Author: Anne van Kesteren <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-001-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-001.html
R
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-001.tentative-expected.txt
R
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-001.tentative.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-002-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-002.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-owner-001-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-owner-001.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/form-element-pointer-in-template-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/form-element-pointer-in-template.html
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url_file=template-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_file=template-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single_file=template-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/resources/template.dat
M Source/WebCore/html/parser/HTMLConstructionSite.cpp
M Source/WebCore/html/parser/HTMLConstructionSite.h
M Source/WebCore/html/parser/HTMLTreeBuilder.cpp
M Source/WebCore/html/parser/HTMLTreeBuilder.h
Log Message:
-----------
Ignore the form element pointer when fragment parsing with a <template>
context element
https://bugs.webkit.org/show_bug.cgi?id=323586
Reviewed by Chris Dumez.
The form element pointer is meant to be ignored inside template contents, but
isParsingTemplateContents() only consulted the stack of open elements. A
fragment
parse whose context element is a template element produces template contents
without ever pushing a template element onto that stack, so setting innerHTML on
a template element used the pointer anyway. Given
<form><template id=t></template></form>
then t.innerHTML = "<div><form></div><input></form>" dropped the nested <form>,
because the pointer had been seeded from the template's form ancestor.
Two more cases went wrong without any form ancestor, because a <form> in the
markup set the pointer. t.innerHTML = "<form><form>" dropped the second <form>,
and t.innerHTML = "<br>BC<form>D<div>E</form>F</div>G" took the pointer-based
</form> branch, which removes the form element from the stack of open elements
and leaves the <div> open, rather than the branch used for template contents,
which pops through it. The same markup written inside <template> in a document
produced a different tree as a result.
Extend isParsingTemplateContents() to also cover a template context element, and
pass the result into insertHTMLFormElement() instead of having it re-derive the
narrower condition from the stack of open elements, so the "in body" and "in
table" <form> start tags agree with it.
Matches https://github.com/whatwg/html/pull/12911.
Tests:
imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-001.html
imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-002.html
imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-owner-001.html
imported/w3c/web-platform-tests/html/syntax/parsing/form-element-pointer-in-template.html
Tests upstream: https://github.com/web-platform-tests/wpt/pull/62488
Canonical link: https://commits.webkit.org/320641@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
