From eb714a4416d372811e20d591521f997cef9c2abc Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Sun, 19 Jul 2026 17:38:18 +0200 Subject: [PATCH] Drop a node the adoption agency cannot reinsert MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The adoption agency algorithm's "Insert lastNode ... at the adjusted insertion location" step moves an already-inserted node. Script running during parsing can reparent that node first, so the move would either form a cycle — including one that crosses a shadow root or a template's contents, i.e. where lastNode is a host-including inclusive ancestor of the target — or target a Document that already has an element child. The step used a low-level insertion with no validity check, so such a move built a cyclic or otherwise invalid tree. Tests: https://github.com/web-platform-tests/wpt/pull/61398 --- source | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/source b/source index e686e218791..973a4a193df 100644 --- a/source +++ b/source @@ -3323,8 +3323,9 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute descendant, shadow-including ancestor, shadow-including descendant, - shadow-including inclusive descendant, and - shadow-including inclusive ancestor concepts + shadow-including inclusive descendant, + shadow-including inclusive ancestor, and + host-including inclusive ancestor concepts
  • The first child, last child, next sibling, @@ -3343,7 +3344,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • The find flattened slottables algorithm
  • The manual slot assignment concept
  • The assign a slot algorithm
    • -
  • The pre-insert, insert, append, replace, replace all, string replace all, remove, and adopt algorithms for nodes
    • +
  • The pre-insert, ensure pre-insert validity, insert, append, replace, replace all, string replace all, remove, and adopt algorithms for nodes
  • The descendant concept
  • The insertion steps,
  • The post-connection steps, @@ -147003,8 +147004,32 @@ document.body.appendChild(text);

  • Let insertionLocation be commonAncestor, after its last child, if any.

    • -

  • Insert whatever lastNode ended up being in the previous step at the - adjusted insertion location given insertionLocation.

    • +

  • Let adjustedInsertionLocation be the adjusted insertion location + given insertionLocation.

    • + +
  • +

    If either of the following is true:

    + + + +

    then remove lastNode.

    + +

    Otherwise:

    + +
      +

    1. Assert: ensure pre-insert validity given + lastNode, the node in which adjustedInsertionLocation finds itself, + null, and « » does not throw.

      2. + +

    2. Insert lastNode at adjustedInsertionLocation.

      3. +
    +

  • Create an element for the token for which formattingElement was created, in the HTML namespace, with furthestBlock as the intended parent.