Agent's active custom element constructor map can have null registries, causing problems #11256
Description
What is the issue with the HTML Standard?
With this test case based on https://wpt.live/custom-elements/registries/CustomElementRegistry-upgrade.html :
<!DOCTYPE html>
<some-host id="host">
<template shadowrootmode="closed" shadowrootcustomelementregistry>
<a-b></a-b>
</template>
</some-host>
<script>
customElements.define('a-b', class GlobalABElement extends HTMLElement { });
</script>Running this with my changes in Ladybird:
- "Upgrade an element" step 8 puts a constructor in the map with a null registry.
- "HTML element constructors" step 3 says:
If the surrounding agent's active custom element constructor map[NewTarget] exists:
And as far as I can tell, "exists" just means it has an entry, and so it's true even if that entry is null. registrygets assigned to that, so it's null too.- Step 5 of that algorithm then makes use of
registry, and explodes.
Changing "HTML element constructors" step 3 to also check for non-null fixes the issue.
I'm not sure if we even should have null registries in that map. In step 1 above, is the element supposed to have a null registry? As far as I can tell I'm assigning the element's registry where I'm supposed to, so I think it's correct. But I have been staring at this for too long so I might be missing something.
cc: @annevk