Restore active custom element constructor map entries after construction#1494
Merged
annevk merged 1 commit intoJul 17, 2026
Merged
Conversation
Create an element sets the active custom element constructor map entry for the constructor it is about to construct, then removed it once construction finished. A re-entrant construction of the same constructor for a different registry therefore clobbered the outer entry, and its removal left the outer construction to resolve against the wrong registry. Save the previous entry before setting it and restore it afterwards, so the outer registry survives a re-entrant construction. This mirrors the same change to the HTML element constructor and upgrade an element. See whatwg/html#12696.
keithamus
reviewed
Jul 17, 2026
Comment on lines
+7067
to
+7073
| <li><p>If <var>previousRegistry</var> is null, then <a for=map>remove</a> the | ||
| <a>surrounding agent</a>'s | ||
| <a for="similar-origin window agent">active custom element constructor map</a>[<var>C</var>]. | ||
|
|
||
| <p class=note>Under normal circumstances it will already have been removed at this point. | ||
| <li><p>Otherwise, <a for=map>set</a> the <a>surrounding agent</a>'s | ||
| <a for="similar-origin window agent">active custom element constructor map</a>[<var>C</var>] to | ||
| <var>previousRegistry</var>. |
Member
There was a problem hiding this comment.
The HTML spec has these two steps combined, but DOM has them as 2 discrete steps. Any particular reason why?
Member
Author
There was a problem hiding this comment.
Oversight; I've now made it two steps in HTML as well.
annevk
added a commit
to whatwg/html
that referenced
this pull request
Jul 17, 2026
The active custom element constructor map is keyed by constructor, so a re-entrant upgrade of the same constructor for a different registry overwrote the outer upgrade's entry. Because the entry was then removed (on read in the HTML element constructor, and unconditionally when the upgrade finished), the outer super() call lost its registry and resolved against the wrong one. Save the previous entry before setting it and restore it afterwards, and stop removing it when read, so that the outer registry survives a re-entrant upgrade. DOM PR: whatwg/dom#1494 Tests: web-platform-tests/wpt#61364 Fixes #12691.
annevk
added a commit
to annevk/WebKit
that referenced
this pull request
Jul 18, 2026
https://bugs.webkit.org/show_bug.cgi?id=319658 Reviewed by NOBODY (OOPS!). Keith Cirkel pointed out that the constructor map as defined did not quite work and also that WebKit did not implement it. This aligns WebKit with the proposed changes to DOM and HTML and also adds some additional test coverage for the gaps: - whatwg/dom#1494 - whatwg/html#12696 Tests: imported/w3c/web-platform-tests/custom-elements/createElement-reentrant-construction.window.html imported/w3c/web-platform-tests/custom-elements/registries/constructor-direct-call-fallback-registry.window.html imported/w3c/web-platform-tests/custom-elements/registries/constructor-reentry-createElement.window.html
webkit-commit-queue
pushed a commit
to annevk/WebKit
that referenced
this pull request
Jul 18, 2026
https://bugs.webkit.org/show_bug.cgi?id=319658 Reviewed by Ryosuke Niwa. Keith Cirkel pointed out that the constructor map as defined did not quite work and also that WebKit did not implement it. This aligns WebKit with the proposed changes to DOM and HTML and also adds some additional test coverage for the gaps: - whatwg/dom#1494 - whatwg/html#12696 Tests: imported/w3c/web-platform-tests/custom-elements/createElement-reentrant-construction.window.html imported/w3c/web-platform-tests/custom-elements/registries/constructor-direct-call-fallback-registry.window.html imported/w3c/web-platform-tests/custom-elements/registries/constructor-reentry-createElement.window.html Canonical link: https://commits.webkit.org/317462@main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Create an element sets the active custom element constructor map entry for the constructor it is about to construct, then removed it once construction finished. A re-entrant construction of the same constructor for a different registry therefore clobbered the outer entry, and its removal left the outer construction to resolve against the wrong registry.
Save the previous entry before setting it and restore it afterwards, so the outer registry survives a re-entrant construction. This mirrors the same change to the HTML element constructor and upgrade an element.
See whatwg/html#12696.
(See WHATWG Working Mode: Changes for more details.)
Preview | Diff