Prevent infinite loop in revealing algorithms #11457

josepharhar · 2025-07-15T19:08:36Z

The ancestor details revealing algorithm and the hidden until found revealing algorithm may both get stuck in infinite loops because they iterate the flat tree while firing synchronous events. If the page were to listen to these events and change the flat tree in response, then the algorithm could theoretically never end.

Fixes #11436

At least two implementers are interested (and none opposed):
- Chromium
- WebKit
Tests are written and can be reviewed and commented upon at:
- Add beforematch infinite loop test web-platform-tests/wpt#53789
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/433545121
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1980442
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=296797
Corresponding HTML AAM & ARIA in HTML issues & PRs: Not needed
MDN issue is filed: Not needed
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/browsing-the-web.html ( diff )
/interaction.html ( diff )
/interactive-elements.html ( diff )

The ancestor details revealing algorithm and the hidden until found revealing algorithm may both get stuck in infinite loops because they iterate the flat tree while firing synchronous events. If the page were to listen to these events and change the flat tree in response, then the algorithm could theoretically never end. Fixes whatwg#11436

domenic

Editorially LGTM, although some implementer review from @nt1m and/or @jnjaeschke would be appreciated.

nt1m

I think going through every single ancestor twice is very unefficient. The second loop should only go through relevant elements, rather than all of the ancestors again. I know it may result in some behavior difference in some very specific edge cases, but I'd rather have an efficient algorithm here.

source

annevk · 2025-07-16T07:28:49Z

Yeah, this seems like the right time to combine these algorithms so we only do a single tree walk. That's an observable change in behavior due to the events, but I think it's very much an acceptable one. And if we ever add more cases we care about we don't end up with ever more ancestor walks.

nt1m · 2025-07-16T08:24:22Z

Just to be clear, I was pointing out that the current PR collects all the ancestors into a list for both algorithms, instead of only the relevant ones for each algorithm, which is different from what Anne mentioned in the previous comment.

(But having 1 reveal algorithm instead of 2 separate ones as Anne suggests wouldn't be something I'm opposed to, if the change in order of events/revealing makes sense for web developers)

annevk · 2025-07-16T12:06:59Z

@nt1m and I discussed this some more and while in theory you could do a single ancestor walk and collect the nodes to dispatch events on in separate lists depending on the feature, my suspicion is that it would be more useful for web developers if the events are also collapsed into a single reverse-tree-ordered list.

josepharhar · 2025-07-16T20:46:44Z

Thanks, I combined the algorithms and only stored relevant nodes for the second traversal. How does it look?

source

annevk

After we fire the first event, do we want to check for each node we go through that it's still connected?

And maybe check that the pre-conditions are still valid?

And maybe that if any of that is no longer true, we return early as we're no longer sure what we're dealing with.

source

josepharhar · 2025-07-22T22:14:15Z

After we fire the first event, do we want to check for each node we go through that it's still connected?

And maybe check that the pre-conditions are still valid?

And maybe that if any of that is no longer true, we return early as we're no longer sure what we're dealing with.

I added checks to make sure that each ancestor to reveal is still connected and still has the open attribute if its a details or still has hidden=until-found otherwise, and stop the algorithm if any of those are not true

annevk

Looks pretty good. Couple of nits.

source

annevk

Looks good to me, modulo a couple of nits.

source

annevk · 2025-07-30T12:22:47Z

@jnjaeschke @nt1m do we already have bugs tracking this change for Gecko and WebKit?

jnjaeschke · 2025-07-30T12:46:10Z

There's no Gecko bug that I know of.

josepharhar · 2025-07-31T16:17:06Z

I filed a gecko bug and put it in the OP

nt1m · 2025-07-31T16:30:38Z

source

+       <li><p>If <var>ancestorToReveal</var> is not <span>connected</span>, then return.</p></li>
+
+       <li><p>If <var>ancestorToReveal</var>'s <code data-x="attr-hidden">hidden</code> attribute is
+       not in the <span data-x="attr-hidden-until-found-state">Hidden Until Found</span> state, then
+       return.</p></li>
+


I'm currently discussing this with @annevk but I'm not convinced these checks are good for component based websites. The fact that child components can break parent components behaviors seems pretty unexpected to me. E.g. a parent component that is expecting revealing behavior on find-in-page should not have that be unintentionally prevented by a child component getting removed.

I think this PR can be merged as is for now, I'll raise a follow up issue if needed.

https://bugs.webkit.org/show_bug.cgi?id=296797 rdar://157280008 Reviewed by NOBODY (OOPS!). Follow whatwg/html#11457 * Source/WebCore/dom/FindRevealAlgorithms.cpp: (WebCore::revealClosedDetailsAndHiddenUntilFoundAncestors): (WebCore::revealClosedDetailsAncestors): Deleted. (WebCore::revealHiddenUntilFoundAncestors): Deleted. * Source/WebCore/dom/FindRevealAlgorithms.h:

https://bugs.webkit.org/show_bug.cgi?id=296797 rdar://157280008 Reviewed by NOBODY (OOPS!). Follow whatwg/html#11457 * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details.html: Added. * Source/WebCore/dom/FindRevealAlgorithms.cpp: (WebCore::revealClosedDetailsAndHiddenUntilFoundAncestors): (WebCore::revealClosedDetailsAncestors): Deleted. (WebCore::revealHiddenUntilFoundAncestors): Deleted. * Source/WebCore/dom/FindRevealAlgorithms.h:

https://bugs.webkit.org/show_bug.cgi?id=296797 rdar://157280008 Reviewed by NOBODY (OOPS!). Follow whatwg/html#11457 Also write a bunch of new WPT for ordering & state mutations during the beforematch event. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-infinite-loop-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details.html: Added. * Source/WebCore/dom/FindRevealAlgorithms.cpp: (WebCore::revealClosedDetailsAndHiddenUntilFoundAncestors): (WebCore::revealClosedDetailsAncestors): Deleted. (WebCore::revealHiddenUntilFoundAncestors): Deleted. * Source/WebCore/dom/FindRevealAlgorithms.h:

https://bugs.webkit.org/show_bug.cgi?id=296797 rdar://157280008 Reviewed by NOBODY (OOPS!). Follow whatwg/html#11457 which: - Prevents infinite looping due to mutations on the beforematch event, by collecting the ancestors beforehand (covered by beforematch-infinite-loop.html) - Combines both details and hidden=until-found ancestor revealing algorithms into a single one, to avoid two separate traversals (covered by hidden-until-found-and-details.html) - Adds checks for attribute/element removal mutations during the beforematch event (covered by removal WPTs) Also write WPTs for previously uncovered parts. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-infinite-loop-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details.html: Added. * Source/WebCore/dom/FindRevealAlgorithms.cpp: (WebCore::revealClosedDetailsAndHiddenUntilFoundAncestors): (WebCore::revealClosedDetailsAncestors): Deleted. (WebCore::revealHiddenUntilFoundAncestors): Deleted. * Source/WebCore/dom/FindRevealAlgorithms.h:

nt1m · 2025-08-02T04:43:27Z

@josepharhar @jnjaeschke I wrote a bunch of WPTs here: web-platform-tests/wpt#54116

https://bugs.webkit.org/show_bug.cgi?id=296797 rdar://157280008 Reviewed by NOBODY (OOPS!). Follow whatwg/html#11457 which: - Prevents infinite looping due to mutations on the beforematch event, by collecting the ancestors beforehand (covered by beforematch-infinite-loop.html) - Combines both details and hidden=until-found ancestor revealing algorithms into a single one, to avoid two separate traversals (covered by hidden-until-found-and-details.html) - Adds checks for attribute/element removal mutations during the beforematch event (covered by removal WPTs) Also write WPTs for previously uncovered parts. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-infinite-loop-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details.html: Added. * Source/WebCore/dom/FindRevealAlgorithms.cpp: (WebCore::revealClosedDetailsAndHiddenUntilFoundAncestors): (WebCore::revealClosedDetailsAncestors): Deleted. (WebCore::revealHiddenUntilFoundAncestors): Deleted. * Source/WebCore/dom/FindRevealAlgorithms.h:

https://bugs.webkit.org/show_bug.cgi?id=296797 rdar://157280008 Reviewed by Darin Adler. Follow whatwg/html#11457 which: - Prevents infinite looping due to mutations on the beforematch event, by collecting the ancestors beforehand (covered by beforematch-infinite-loop.html) - Combines both details and hidden=until-found ancestor revealing algorithms into a single one, to avoid two separate traversals (covered by hidden-until-found-and-details.html) - Adds checks for attribute/element removal mutations during the beforematch event (covered by removal WPTs) Also write WPTs for previously uncovered parts. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-attribute-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-001.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-element-removal-002.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/beforematch-infinite-loop-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/editing/the-hidden-attribute/hidden-until-found-and-details.html: Added. * Source/WebCore/dom/FindRevealAlgorithms.cpp: (WebCore::revealClosedDetailsAndHiddenUntilFoundAncestors): (WebCore::revealClosedDetailsAncestors): Deleted. (WebCore::revealHiddenUntilFoundAncestors): Deleted. * Source/WebCore/dom/FindRevealAlgorithms.h: Canonical link: https://commits.webkit.org/298164@main

This patch implements the spec changes for the auto-expanding algorithms for details elements and hidden=until-found: whatwg/html#11457 I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/SeRScSVsUXY Fixed: 433545121 Change-Id: I09d58f2c1b97c98c33d9c577369cb877198404c5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6821516 Reviewed-by: Mason Freed <[email protected]> Commit-Queue: Joey Arhar <[email protected]> Cr-Commit-Position: refs/heads/main@{#1500237}

josepharhar mentioned this pull request Jul 15, 2025

hidden=until-found and details revealing algorithms can loop infinitely #11436

Closed

fix nesting

1b704f0

nt1m requested a review from annevk July 15, 2025 20:32

domenic approved these changes Jul 16, 2025

View reviewed changes

nt1m reviewed Jul 16, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

josepharhar added 2 commits July 16, 2025 13:33

Merge branch 'main' into reveal

291da97

combine algorithms and reduce traversals

6ef4377

jnjaeschke reviewed Jul 17, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

annevk reviewed Jul 17, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

combine list and check preconditions

f7f0dfd

add missing li

a1e9079

annevk reviewed Jul 23, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

nt1m reviewed Jul 23, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

nits

7b0c806

annevk reviewed Jul 24, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

josepharhar added 3 commits July 28, 2025 08:11

nits

ea3aa49

Merge branch 'main' into reveal

7af4736

use a tuple

61af6a0

annevk approved these changes Jul 29, 2025

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

source Show resolved Hide resolved

nt1m reviewed Jul 29, 2025

View reviewed changes

source Show resolved Hide resolved

nits

80cc559

annevk approved these changes Jul 30, 2025

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

improve tuple destructor

85646c4

nt1m reviewed Jul 31, 2025

View reviewed changes

annevk merged commit 55baf05 into whatwg:main Aug 1, 2025
2 checks passed

nt1m mentioned this pull request Aug 1, 2025

Update details and hidden=until-found ancestor revealing algorithm WebKit/WebKit#48840

Merged

nt1m mentioned this pull request Aug 4, 2025

Add new tests for <details> focus area web-platform-tests/interop#984

Closed

Prevent infinite loop in revealing algorithms #11457

Prevent infinite loop in revealing algorithms #11457

Uh oh!

Conversation

josepharhar commented Jul 15, 2025 • edited by pr-preview bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

domenic left a comment

Choose a reason for hiding this comment

Uh oh!

nt1m left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

annevk commented Jul 16, 2025

Uh oh!

nt1m commented Jul 16, 2025

Uh oh!

annevk commented Jul 16, 2025

Uh oh!

josepharhar commented Jul 16, 2025

Uh oh!

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

josepharhar commented Jul 22, 2025

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

annevk commented Jul 30, 2025

Uh oh!

jnjaeschke commented Jul 30, 2025

Uh oh!

josepharhar commented Jul 31, 2025

Uh oh!

nt1m Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

nt1m Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nt1m commented Aug 2, 2025

Uh oh!

Uh oh!

josepharhar commented Jul 15, 2025 •

edited by pr-preview bot

Loading