Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 537fe4583eb1cd41e4748ed87385fcae0a16ec96
https://github.com/WebKit/WebKit/commit/537fe4583eb1cd41e4748ed87385fcae0a16ec96
Author: Anne van Kesteren <[email protected]>
Date: 2026-09-29 (Tue, 29 Sep 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-disconnected-id-map-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-disconnected-id-map.html
A
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-boundary-id-change-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-boundary-id-change.html
A
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-host-id-map-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-host-id-map.html
M
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/w3c-import.log
A
LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/selectedcontent-subtree-mutations-expected.txt
M Source/WebCore/dom/ContainerNode.cpp
M Source/WebCore/dom/Element.cpp
M Source/WebCore/dom/Element.h
M Source/WebCore/dom/Node.cpp
M Source/WebCore/dom/Node.h
M Source/WebCore/html/HTMLImageElement.cpp
M Source/WebCore/html/HTMLImageElement.h
M Source/WebCore/html/HTMLOptionElement.cpp
M Source/WebCore/html/HTMLOptionElement.h
M Source/WebCore/html/HTMLSelectedContentElement.cpp
M Source/WebCore/html/HTMLSelectedContentElement.h
M Source/WebCore/html/HTMLSourceElement.cpp
M Source/WebCore/html/HTMLSourceElement.h
Log Message:
-----------
moveBefore() updates id and name maps of shadow trees inside the moved
subtree against the wrong tree scope
https://bugs.webkit.org/show_bug.cgi?id=325616
Reviewed by Ryosuke Niwa.
Element::movingSteps() updated the id and name maps of every element in the
moved subtree against the old parent's tree scope. That is wrong for elements in
a shadow tree inside the moved subtree, whose tree scope does not change: they
were removed from the old parent's maps, which they were never in, and
registered a second time in their own. Moving a <select> or <details> does this,
as their user agent shadow trees contain a named <slot>. It is also wrong inside
a disconnected tree: the old parent's tree scope is then the document, whose
maps those elements are not in. That is bug 324715.
The moving steps now receive whether the node was removed from the old parent's
tree scope and inserted into the new parent's, computed like treeScopeChanged
for the removal and insertion steps, and Element::movingSteps() reuses the id
and name bookkeeping of those steps.
Node::movingSteps() now also updates the IsInShadowTree flag, as the removal and
insertion steps do. It was stale after moving a node into or out of a shadow
tree, so later changes to the node's id or name updated the wrong maps, which
could crash.
selectedcontent-subtree-mutations.html no longer needs to be skipped.
Tests:
imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-disconnected-id-map.html
imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-boundary-id-change.html
imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-host-id-map.html
Canonical link: https://commits.webkit.org/322249@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
