Re: Foster-parenting and taint

On Wed, 25 Feb 2009, Henri Sivonen wrote:
>
> Consider:
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3C!--%20--%3Ex%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3C!--%20--%3E%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3Ex%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3Cscript%3E%3C%2Fscript%3Ex%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3Cscript%3E%3C%2Fscript%3E%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3Cstyle%3E%3C%2Fstyle%3E%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3Cstyle%3E%3C%2Fstyle%3Ex%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3Cinput%20type%3Dhidden%3Ex%20%3C%2Ftable%3E
> http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3Cinput%20type%3Dhidden%3E%20%3C%2Ftable%3E
> 
> Results:
> From black-box behavior, it seems that Gecko manages table taint and
> foster-parents space characters, comments and <style> based on taint. <script>
> and <input type=hidden> are not foster-parented, regardless of taint. Also,
> text nodes in the DOM that resulted from discontiguous runs of character
> tokens are not joined.
> 
> From black-box behavior, it seems that WebKit accumulates a run of text into a
> buffer, flushes the buffer late, makes the decision to foster parent on a per
> flush basis and doesn't join text nodes in the DOM that resulted from
> discontiguous runs of character tokens. <script> is not foster-parented, and
> <style> is hoisted to <head>. <input type=hidden> is always foster-parented.
> 
> [...] Per spec, there is taint and space characters, <script>, <style> 
> and <input type=hidden> are taint-sensitive but comments are not.
> 
> Questions:
> Why are <script> and <input type=hidden> taint-sensitive in the spec 
> when they aren't taint-sensitive in Gecko and script is not foster 
> parented by WebKit, either?

Mostly because it seemed easier to make everything foster-parented once 
things are tainted.


> Could we get away with foster-parenting <style> unconditionally?

I've made <script>, <style>, and <input type=hidden> unconditional.


> For space characters, is there a reason to prefer Gecko-style taint over
> WebKit-style late flushing and per-flush inspection of the buffer for
> non-space characters?
> 
> Concretely, would the following work:
>  1) Characters are buffered and are flushed immediately ahead of the next
>     non-character insertion to the DOM.
>  2) If the run of characters being flushed doesn't consist entirely of space
>     characters, the run is foster parented.

The spec is compatible with IE (and Opera) on this test:

   http://software.hixie.ch/utilities/js/live-dom-viewer/saved/92

WebKit's behaviour (as you describe above) is not compatible with this.

(Ironically, Gecko's behaviour isn't compatible with IE. Not sure what's 
going on there.)


>  3) Comments, <script> and <input type=hidden> are not foster parented.

This is now the case.


>  4) Other elements, including <style>, are foster parented.

<style> isn't for future extensibility. The others are.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'

Received on Sunday, 26 April 2009 04:15:49 UTC