Skip to content

Fix insertAdjacentHTML and outerHTML using wrong customElementRegistry#59458

Open
chromium-wpt-export-bot wants to merge 1 commit into
masterfrom
chromium-export-cl-7789715
Open

Fix insertAdjacentHTML and outerHTML using wrong customElementRegistry#59458
chromium-wpt-export-bot wants to merge 1 commit into
masterfrom
chromium-export-cl-7789715

Conversation

@chromium-wpt-export-bot
Copy link
Copy Markdown
Collaborator

@chromium-wpt-export-bot chromium-wpt-export-bot commented Apr 24, 2026

insertAdjacentHTML with 'beforebegin'/'afterend' and the outerHTML setter
were incorrectly passing the calling element's customElementRegistry to
the HTML fragment parser, instead of the containing scope's (parent's)
registry.

For 'beforebegin'/'afterend', new nodes become siblings under the
parent, so they should inherit the parent's registry. The code already
correctly resolved context_node to the parent, but the registry was
still taken from 'this' element.

The fix derives the registry from context_node: if it's an Element, use
its customElementRegistry(); otherwise fall back to the tree scope's
registry (handles ShadowRoot and DocumentFragment parents).

Bug: 489973914
Change-Id: I31658ed4c95039a92ee883ee57782e8947c206fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7789715
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Jayson Chen <jaysonchen@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1620451}

Copy link
Copy Markdown
Collaborator

@wpt-pr-bot wpt-pr-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The review process for this patch is being conducted in the Chromium project.

insertAdjacentHTML with 'beforebegin'/'afterend' and the outerHTML setter
were incorrectly passing the calling element's customElementRegistry to
the HTML fragment parser, instead of the containing scope's (parent's)
registry.

For 'beforebegin'/'afterend', new nodes become siblings under the
parent, so they should inherit the parent's registry. The code already
correctly resolved context_node to the parent, but the registry was
still taken from 'this' element.

The fix derives the registry from context_node: if it's an Element, use
its customElementRegistry(); otherwise fall back to the tree scope's
registry (handles ShadowRoot and DocumentFragment parents).

Bug: 489973914
Change-Id: I31658ed4c95039a92ee883ee57782e8947c206fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7789715
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Jayson Chen <jaysonchen@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1620451}
@jonathan-j-lee jonathan-j-lee force-pushed the chromium-export-cl-7789715 branch from 6f6fa07 to 2ecb128 Compare May 11, 2026 20:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants