HTML Parser: Update formatting element list bookmarks on element removal

https://bugs.webkit.org/show_bug.cgi?id=246936 Reviewed by Ryosuke Niwa. When elements are removed from the formatting element list, the position in the list of the element bookmarked might change, so make sure that bookmarks are updated when needed. * Source/WebCore/html/parser/HTMLFormattingElementList.cpp: (WebCore::HTMLFormattingElementList::removeUpdatingBookmark): * Source/WebCore/html/parser/HTMLFormattingElementList.h: * Source/WebCore/html/parser/HTMLTreeBuilder.cpp: (WebCore::HTMLTreeBuilder::callTheAdoptionAgency): Canonical link: https://commits.webkit.org/255907@main
WebKit · Oct 24, 2022 · a2e027e · a2e027e
1 parent 355426c
commit a2e027e
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 1 deletion.
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
@@ -103,6 +103,20 @@ void HTMLFormattingElementList::remove(Element& element)
         m_entries.remove(index);
 }
 
+void HTMLFormattingElementList::removeUpdatingBookmark(Element& element, Bookmark& bookmark)
+{
+    size_t index = m_entries.reverseFind(&element);
+    if (index != notFound) {
+        size_t bookmarkIndex = &bookmark.mark() - &first();
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(bookmarkIndex <= size());
+        m_entries.remove(index);
+        // Removing an element from the list can change the position of the bookmarked
+        // item. Update the address pointed by the bookmark, when needed.
+        if (bookmarkIndex > index)
+            bookmark.m_mark--;
+    }
+}
+
 void HTMLFormattingElementList::appendMarker()
 {
     m_entries.append(Entry::MarkerEntry);

diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.h b/Source/WebCore/html/parser/HTMLFormattingElementList.h
@@ -92,6 +92,7 @@ class HTMLFormattingElementList {
         Entry& mark() const { ASSERT(m_mark); return *m_mark; }
 
     private:
+        friend class HTMLFormattingElementList;
         bool m_hasBeenMoved;
         Entry* m_mark;
     };
@@ -105,6 +106,7 @@ class HTMLFormattingElementList {
     bool contains(Element&);
     void append(HTMLStackItem&&);
     void remove(Element&);
+    void removeUpdatingBookmark(Element&, Bookmark&);
 
     Bookmark bookmarkFor(Element&);
     void swapTo(Element& oldElement, HTMLStackItem&& newItem, const Bookmark&);

diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -1564,7 +1564,7 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomHTMLToken& token)
             // 4.13.4.
             bool nodeIsInListOfActiveFormattingElements = m_tree.activeFormattingElements().contains(node->element());
             if (innerLoopCounter > innerIterationLimit && nodeIsInListOfActiveFormattingElements)
-                m_tree.activeFormattingElements().remove(node->element());
+                m_tree.activeFormattingElements().removeUpdatingBookmark(node->element(), bookmark);
             // 4.13.5.
             auto* nodeEntry = m_tree.activeFormattingElements().find(node->element());
             if (!nodeEntry) {