tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

commit 0a74f0c740ab7d83a93e2cc6aae0e46caf2e3fea
parent 1f239f65eb0de5c3600c5b0d3ecdc7fc040a34f5
Author: Jayson Chen <jaysonchen@microsoft.com>
Date:   Fri, 31 Oct 2025 08:54:08 +0000

Bug 1995886 [wpt PR 55605] - [scoped-registry] Ensure uncustomized element can be set to null registry, a=testonly

Automatic update from web-platform-tests
[scoped-registry] Ensure uncustomized element can be set to null registry

This patch fixes the issue where parsing not-yet defined custom element
in function such as innerHTML can accidentally pick up global registry.
The change ensures the uncustomized element is being set to null
registry.

Webkit bug: https://bugs.webkit.org/show_bug.cgi?id=299603

Bug: 448538270
Change-Id: I3adc282657d0af3870bb68af1edd04ab6229528d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7023674
Reviewed-by: Mason Freed <masonf@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Jayson Chen <jaysonchen@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1536178}

--

wpt-commits: 1e7e39bec4e21e6931c86fd19bab40bc263b7c9c
wpt-pr: 55605

Diffstat:
Mtesting/web-platform/tests/custom-elements/registries/Element-innerHTML.html | 31+++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+), 0 deletions(-)

diff --git a/testing/web-platform/tests/custom-elements/registries/Element-innerHTML.html b/testing/web-platform/tests/custom-elements/registries/Element-innerHTML.html @@ -6,6 +6,11 @@ <script src="/resources/testharness.js"></script> <script src="/resources/testharnessreport.js"></script> </head> +<div id="host"> + <template shadowrootmode="open" shadowrootclonable="true" shadowrootcustomelementregistry> + <new-element></new-element> + </template> +</div> <body> <script> @@ -23,6 +28,9 @@ customElements.define('some-element', GlobalSomeElement); class GlobalOtherElement extends HTMLElement { }; customElements.define('other-element', GlobalOtherElement); +class WrongNewElement extends HTMLElement{ }; +customElements.define('new-element', WrongNewElement); + test((test) => { const registry = new CustomElementRegistry; @@ -108,6 +116,29 @@ test((test) => { assert_true(someElement.querySelector('other-element') instanceof ScopedOtherElement1); }, 'innerHTML on an inserted element should continue to use the scoped registry it was created with'); +test((test) => { + const shadowRoot = host.cloneNode(true).shadowRoot; + const container_element = shadowRoot.lastElementChild; + assert_equals(container_element.customElementRegistry, null); + assert_false(container_element instanceof WrongNewElement); + + container_element.innerHTML = '<new-element><new-element></new-element></new-element>'; + const outer_element = container_element.querySelector('new-element'); + const inner_element = outer_element.querySelector('new-element'); + assert_equals(outer_element.customElementRegistry, null); + assert_false(outer_element instanceof WrongNewElement); + assert_equals(inner_element.customElementRegistry, null); + assert_false(inner_element instanceof WrongNewElement); +}, 'nested descendants in innerHTML should use the null registry when the container element has null registry'); + +test((test) => { + const shadowRoot = host.cloneNode(true).shadowRoot; + shadowRoot.firstElementChild.insertAdjacentHTML('afterend', '<new-element></new-element>'); + const container_element = shadowRoot.lastElementChild; + assert_equals(container_element.customElementRegistry, null); + assert_false(container_element instanceof WrongNewElement); +}, 'insertAdjacentHTML should use the element\'s registry even when the registry is null'); + </script> </body> </html>