Cherry-pick 980a1d5. rdar://121612950

    Restrict didFinishInsertingNode to connected nodes
    https://bugs.webkit.org/show_bug.cgi?id=268051

    Reviewed by Wenson Hsieh.

    Don't call didFinishInsertingNode when a node is not connected to a document.

    * Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
    (WebCore::notifyNodeInsertedIntoTree):
    (WebCore::notifyChildNodeInserted):
    * Source/WebCore/html/HTMLFormControlElement.cpp:
    (WebCore::HTMLFormControlElement::insertedIntoAncestor):
    * Source/WebCore/html/HTMLInputElement.cpp:
    (WebCore::HTMLInputElement::insertedIntoAncestor):
    * Source/WebCore/html/HTMLMaybeFormAssociatedCustomElement.cpp:
    (WebCore::HTMLMaybeFormAssociatedCustomElement::insertedIntoAncestor):
    * Source/WebCore/html/HTMLMediaElement.cpp:
    (WebCore::HTMLMediaElement::insertedIntoAncestor):
    * Source/WebCore/html/HTMLObjectElement.cpp:
    (WebCore::HTMLObjectElement::insertedIntoAncestor):
    * Source/WebCore/html/ValidatedFormListedElement.cpp:
    (WebCore::ValidatedFormListedElement::insertedIntoAncestor): Call resetFormOwner when this insertion
    didn't result in getting connected to a new document since didFinishInsertingNode won't be called in
    such cases. It's okay to call this function synchronously in this case since we don't rely on
    TreeScope::getElementById when the node is not connected to a a document in findAssociatedForm.
    * Source/WebCore/svg/SVGFEImageElement.cpp:
    (WebCore::SVGFEImageElement::insertedIntoAncestor):
    * Source/WebCore/svg/SVGTextPathElement.cpp:
    (WebCore::SVGTextPathElement::insertedIntoAncestor):

    Canonical link: https://commits.webkit.org/273523@main

Identifier: 272448.554@safari-7618.1.15.10-branch

Source/WebCore/dom/ContainerNodeAlgorithms.cpp

@@ -69,27 +69,27 @@ static void notifyNodeInsertedIntoDocument(ContainerNode& parentOfInsertedTree,
     }
 }
 
-static void notifyNodeInsertedIntoTree(ContainerNode& parentOfInsertedTree, Node& node, TreeScopeChange treeScopeChange, NodeVector& postInsertionNotificationTargets)
+static void notifyNodeInsertedIntoTree(ContainerNode& parentOfInsertedTree, Node& node, TreeScopeChange treeScopeChange)
 {
     ASSERT(!parentOfInsertedTree.isConnected());
     ASSERT(!node.isConnected());
 
-    if (node.insertedIntoAncestor(Node::InsertionType { /* connectedToDocument */ false, treeScopeChange == TreeScopeChange::Changed }, parentOfInsertedTree) == Node::InsertedIntoAncestorResult::NeedsPostInsertionCallback)
-        postInsertionNotificationTargets.append(node);
+    auto result = node.insertedIntoAncestor(Node::InsertionType { /* connectedToDocument */ false, treeScopeChange == TreeScopeChange::Changed }, parentOfInsertedTree);
+    ASSERT_UNUSED(result, result == Node::InsertedIntoAncestorResult::Done);
 
     auto* containerNode = dynamicDowncast<ContainerNode>(node);
     if (!containerNode)
         return;
 
     for (RefPtr child = containerNode->firstChild(); child; child = child->nextSibling())
-        notifyNodeInsertedIntoTree(parentOfInsertedTree, *child, treeScopeChange, postInsertionNotificationTargets);
+        notifyNodeInsertedIntoTree(parentOfInsertedTree, *child, treeScopeChange);
 
     auto* element = dynamicDowncast<Element>(*containerNode);
     if (!element)
         return;
 
     if (RefPtr root = element->shadowRoot())
-        notifyNodeInsertedIntoTree(parentOfInsertedTree, *root, TreeScopeChange::DidNotChange, postInsertionNotificationTargets);
+        notifyNodeInsertedIntoTree(parentOfInsertedTree, *root, TreeScopeChange::DidNotChange);
 }
 
 // We intentionally use an out-parameter for postInsertionNotificationTargets instead of returning the vector. This is because
@@ -108,7 +108,7 @@ void notifyChildNodeInserted(ContainerNode& parentOfInsertedTree, Node& node, No
     if (parentOfInsertedTree.isConnected())
         notifyNodeInsertedIntoDocument(parentOfInsertedTree, node, treeScopeChange, postInsertionNotificationTargets);
     else
-        notifyNodeInsertedIntoTree(parentOfInsertedTree, node, treeScopeChange, postInsertionNotificationTargets);
+        notifyNodeInsertedIntoTree(parentOfInsertedTree, node, treeScopeChange);
 }
 
 inline RemovedSubtreeObservability observabilityOfRemovedNode(Node& node)

Source/WebCore/html/HTMLFormControlElement.cpp

@@ -123,6 +123,8 @@ Node::InsertedIntoAncestorResult HTMLFormControlElement::insertedIntoAncestor(In
     HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
     ValidatedFormListedElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
 
+    if (!insertionType.connectedToDocument)
+        return InsertedIntoAncestorResult::Done;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }
 

Source/WebCore/html/HTMLInputElement.cpp

@@ -1699,7 +1699,7 @@ void HTMLInputElement::didChangeForm()
 
 Node::InsertedIntoAncestorResult HTMLInputElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
 {
-    HTMLTextFormControlElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
+    auto result = HTMLTextFormControlElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
 #if ENABLE(DATALIST_ELEMENT)
     resetListAttributeTargetObserver();
 #endif
@@ -1709,6 +1709,8 @@ Node::InsertedIntoAncestorResult HTMLInputElement::insertedIntoAncestor(Insertio
         document().addElementWithPendingUserAgentShadowTreeUpdate(*this);
         m_hasPendingUserAgentShadowTreeUpdate = true;
     }
+    if (!insertionType.connectedToDocument)
+        return result;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }
 

Source/WebCore/html/HTMLMaybeFormAssociatedCustomElement.cpp

@@ -125,7 +125,8 @@ Node::InsertedIntoAncestorResult HTMLMaybeFormAssociatedCustomElement::insertedI
     HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
     if (isFormAssociatedCustomElement())
         formAssociatedCustomElementUnsafe().insertedIntoAncestor(insertionType, parentOfInsertedTree);
-
+    if (!insertionType.connectedToDocument)
+        return InsertedIntoAncestorResult::Done;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }
 

Source/WebCore/html/HTMLMediaElement.cpp

@@ -880,6 +880,8 @@ Node::InsertedIntoAncestorResult HTMLMediaElement::insertedIntoAncestor(Insertio
     if (insertionType.connectedToDocument)
         setInActiveDocument(true);
 
+    if (!insertionType.connectedToDocument)
+        return InsertedIntoAncestorResult::Done;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }
 

Source/WebCore/html/HTMLObjectElement.cpp

@@ -283,6 +283,8 @@ Node::InsertedIntoAncestorResult HTMLObjectElement::insertedIntoAncestor(Inserti
 {
     HTMLPlugInImageElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
     FormListedElement::elementInsertedIntoAncestor(*this, insertionType);
+    if (!insertionType.connectedToDocument)
+        return InsertedIntoAncestorResult::Done;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }
 

Source/WebCore/html/ValidatedFormListedElement.cpp

@@ -327,6 +327,11 @@ void ValidatedFormListedElement::insertedIntoAncestor(Node::InsertionType insert
     syncWithFieldsetAncestors(&parentOfInsertedTree);
 
     FormListedElement::elementInsertedIntoAncestor(asHTMLElement(), insertionType);
+
+    if (!insertionType.connectedToDocument)
+        resetFormOwner();
+    // Need to wait for didFinishInsertingNode to reset form when this element is inserted into a document
+    // because we rely on TreeScope::getElementById to return the right element.
 }
 
 void ValidatedFormListedElement::setDataListAncestorState(TriState isInsideDataList)

Source/WebCore/svg/SVGFEImageElement.cpp

@@ -145,6 +145,8 @@ void SVGFEImageElement::svgAttributeChanged(const QualifiedName& attrName)
 Node::InsertedIntoAncestorResult SVGFEImageElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
 {
     SVGFilterPrimitiveStandardAttributes::insertedIntoAncestor(insertionType, parentOfInsertedTree);
+    if (!insertionType.connectedToDocument)
+        return InsertedIntoAncestorResult::Done;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }
 

Source/WebCore/svg/SVGTextPathElement.cpp

@@ -165,6 +165,8 @@ void SVGTextPathElement::buildPendingResource()
 Node::InsertedIntoAncestorResult SVGTextPathElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
 {
     SVGTextContentElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
+    if (!insertionType.connectedToDocument)
+        return InsertedIntoAncestorResult::Done;
     return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
 }