Aliaksandr Kalenik c44c36416e LibWeb: Preserve old insertion points across reentrant scripts ...

The HTML parser's script end tag algorithms save the current insertion
point in an "old insertion point" local before executing a script, then
restore that local after script execution. Ladybird modeled that local
as a single tokenizer field, so nested script execution via
document.write() could overwrite the outer script's saved value.

Keep a stack of old insertion points instead, and adjust saved offsets
when document.write() inserts new input before them. This keeps the
normal script and SVG script paths aligned with the spec text while
leaving the parser-blocking script resume path to set the insertion
point to undefined again.

2026-04-27 18:02:19 +02:00

271 KiB

Raw Blame History

View Raw