Drop a node the adoption agency cannot reinsert#12709
Open
annevk wants to merge 1 commit into
Open
Conversation
The adoption agency algorithm's "Insert lastNode ... at the adjusted insertion location" step moves an already-inserted node. Script running during parsing can reparent that node first, so the move would either form a cycle — including one that crosses a shadow root or a template's contents, i.e. where lastNode is a host-including inclusive ancestor of the target — or target a Document that already has an element child. The step used a low-level insertion with no validity check, so such a move built a cyclic or otherwise invalid tree. Tests: web-platform-tests/wpt#61398
brave-builds
pushed a commit
to brave/chromium
that referenced
this pull request
Jul 20, 2026
Make a few check when moving around nodes with AAA. The tests are internal temporarily until the upstream WPT and spec PR land, but that process shouldn't delay fixing the crash. See whatwg/html#12709 Bug: 536662911 Change-Id: Ia357a2efea8029129b68b7fe647de4d7ba450b42 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8124514 Commit-Queue: Noam Rosenthal <nrosenthal@google.com> Reviewed-by: David Baron <dbaron@chromium.org> Cr-Commit-Position: refs/heads/main@{#1664983}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drop a node the adoption agency cannot reinsert
The adoption agency algorithm's "Insert lastNode ... at the adjusted insertion
location" step moves an already-inserted node. Script running during parsing can
reparent that node first, so the move would either form a cycle — including one
that crosses a shadow root or a template's contents, i.e. where lastNode is a
host-including inclusive ancestor of the target — or target a Document that
already has an element child. The step used a low-level insertion with no
validity check, so such a move built a cyclic or otherwise invalid tree.
Tests: web-platform-tests/wpt#61398
(See WHATWG Working Mode: Changes for more details.)
/infrastructure.html ( diff )
/parsing.html ( diff )