Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e3fd423207b7044c4c2a238a3dc9c89170e32a87
https://github.com/WebKit/WebKit/commit/e3fd423207b7044c4c2a238a3dc9c89170e32a87
Author: Anne van Kesteren <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-moved-table.window-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-moved-table.window.html
A
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-moved-table.window.js
M
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/w3c-import.log
M Source/WebCore/html/parser/HTMLConstructionSite.cpp
M Source/WebCore/html/parser/HTMLConstructionSite.h
Log Message:
-----------
Foster parenting should use the table's current parent
https://bugs.webkit.org/show_bug.cgi?id=323086
rdar://186340113
Reviewed by Chris Dumez.
The appropriate place for inserting a node is computed for every insertion, and
with
foster parenting enabled it is derived from the on-stack table's current
parent. We
computed it when queueing the task instead, so script running from an earlier
task in
the same flush could move the table and leave a later task holding a parent and
a
reference child that no longer belong together.
Processing a single "nobr" start tag reaches this. It foster parents once while
reconstructing the active formatting elements, and again after the adoption
agency
algorithm finds no furthest block and pops the stack of open elements back to
the "tr".
When script has made a script element the table's parent, that element is the
foster
parent, so the first of those insertions runs it.
319453@main stopped the resulting tree corruption by dropping the later
insertion on the
floor. That is safe but is not what the standard asks for. Split the computation
instead: recordFosterSite() keeps the parts derived from the stack of open
elements, and
resolveFosterSite() derives the parent from the table when the task runs. This
also
covers the table having no parent by then, where the foster parent is the
element
immediately above it in the stack of open elements.
The reference child check has to happen before the template element branch,
because the
parent it resolves to can be a template element, and insertions then have to be
redirected into its template contents. Without that ordering the case asserts in
ContainerNode::parserInsertBefore().
insertTextNode() runs its tasks inline rather than queueing them and reads the
parent
first, so it resolves the foster site itself.
Tests:
imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-moved-table.window.html
Tests upstream: https://github.com/web-platform-tests/wpt/pull/62346
Canonical link: https://commits.webkit.org/320643@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
