Andreas Kling 01f4bbbba7 LibWeb: Abandon Node.replaceChild() if removal rejigs the DOM ...

This isn't directly in the spec, but since replaceChild is implemented
in terms of remove + insert, the removal step may cause arbitrary code
to execute, and so we have to verify that the replaceChild inputs still
make sense afterwards, before doing the insertion.

This roughly matches what WebKit does, and makes a bunch of HTML parsing
tests in WPT stop asserting.

2024-11-24 11:45:23 +01:00

112 KiB

Raw Blame History

View Raw