RESOLVED FIXED325644
moveBefore() leaves <map>, usemap, <label for>, radio group and slot name registrations in the old tree scope 
https://bugs.webkit.org/show_bug.cgi?id=325644
Summary moveBefore() leaves <map>, usemap, <label for>, radio group and slot name reg...
Anne van Kesteren
Reported 2026-09-29 05:54:47 PDT
HTMLMapElement, HTMLImageElement (usemap), HTMLLabelElement (for), HTMLInputElement (radio groups) and HTMLSlotElement (slot names) update their tree scope in insertionSteps() and removingSteps() when treeScopeChanged is set, but not in movingSteps(). Element's scoped custom element registry handling in those steps has the same gap. After moveBefore() across a shadow boundary, they all stay registered with the old tree scope. For <map> this also crashes release builds. Moving a <map> into a shadow root and then hit testing an <img usemap> in the document fails RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(&element->treeScope() == &scope) in TreeScopeOrderedMap::get(), reached through getElementByMapName(): <!DOCTYPE html> <img usemap="#m" width="100" height="100" style="display:block" src="data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=="> <map name="m"><area shape="rect" coords="0,0,100,100" href="#a"></map> <div id="host"></div> <script> host.attachShadow({mode: "open"}).moveBefore(document.querySelector("map"), null); document.elementFromPoint(50, 50); </script> Bug 325616 gives the moving steps oldTreeScopeChanged and newTreeScopeChanged, the counterparts of RemovalType's and InsertionType's treeScopeChanged, so each class can reuse its existing removal and insertion code. This is a crashing part of the audit tracked in bug 314066.
Attachments
Add attachment proposed patch, testcase, etc.
Luke Warlow
Comment 1 2026-09-30 07:29:51 PDT
Pull request: https://github.com/WebKit/WebKit/pull/75397
Luke Warlow
Comment 2 2026-09-30 07:37:02 PDT
WPT Export PR: https://github.com/web-platform-tests/wpt/pull/63108
Luke Warlow
Comment 3 2026-09-30 07:37:20 PDT
Slot names will be handled by a separate patch.
EWS
Comment 4 2026-10-02 03:24:00 PDT
Committed 322482@main (a030dbafac80): <https://commits.webkit.org/322482@main> Reviewed commits have been landed. Closing PR #75397 and removing active labels.
Radar WebKit Bug Importer
Comment 5 2026-10-02 03:24:19 PDT
<rdar://problem/188992616>
Note You need to log in before you can comment on or make changes to this bug.