Foster-parenting and taint

Consider:
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3C!--%20--%3Ex%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3C!--%20--%3E%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3Ex%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3Cscript%3E%3C%2Fscript%3Ex%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3Cscript%3E%3C%2Fscript%3E%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3Cstyle%3E%3C%2Fstyle%3E%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3Cstyle%3E%3C%2Fstyle%3Ex%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20%3Cinput%20type%3Dhidden%3Ex%20%3C%2Ftable%3E
http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3Ex%3Ctable%3E%20x%3Cinput%20type%3Dhidden%3E%20%3C%2Ftable%3E

Results:
 From black-box behavior, it seems that Gecko manages table taint and  
foster-parents space characters, comments and <style> based on taint.  
<script> and <input type=hidden> are not foster-parented, regardless  
of taint. Also, text nodes in the DOM that resulted from discontiguous  
runs of character tokens are not joined.

 From black-box behavior, it seems that WebKit accumulates a run of  
text into a buffer, flushes the buffer late, makes the decision to  
foster parent on a per flush basis and doesn't join text nodes in the  
DOM that resulted from discontiguous runs of character tokens.  
<script> is not foster-parented, and <style> is hoisted to <head>.  
<input type=hidden> is always foster-parented.

Opera and IE prior to IE8 mode don't foster parent in the DOM. The  
visual effect is similar to foster parenting, but content that was  
before the <table> tag in source and content that was after are  
rendered on different lines unlike in Gecko and WebKit.

IE8 mode doesn't even try to achieve the visual effect of foster  
parenting!

Per spec, there is taint and space characters, <script>, <style> and  
<input type=hidden> are taint-sensitive but comments are not.

Questions:
Why are <script> and <input type=hidden> taint-sensitive in the spec  
when they aren't taint-sensitive in Gecko and script is not foster  
parented by WebKit, either?
Could we get away with foster-parenting <style> unconditionally?
For space characters, is there a reason to prefer Gecko-style taint  
over WebKit-style late flushing and per-flush inspection of the buffer  
for non-space characters?

Concretely, would the following work:
  1) Characters are buffered and are flushed immediately ahead of the  
next non-character insertion to the DOM.
  2) If the run of characters being flushed doesn't consist entirely  
of space characters, the run is foster parented.
  3) Comments, <script> and <input type=hidden> are not foster parented.
  4) Other elements, including <style>, are foster parented.
?
-- 
Henri Sivonen
hsivonen@iki.fi
http://hsivonen.iki.fi/

Received on Wednesday, 25 February 2009 13:28:59 UTC