Bug 32393 - Comments and PIs in the internal subset appear as siblings of the doctype
Summary: Comments and PIs in the internal subset appear as siblings of the doctype
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P3 Normal
Assignee: Nobody
Depends on:
Reported: 2009-12-10 13:34 PST by Simon Pieters
Modified: 2019-02-07 04:18 PST (History)
3 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Simon Pieters 2009-12-10 13:34:42 PST
Comments and PIs that appear in the internal subset are inserted to the DOM as children of the document, after the doctype node. This is bogus. In the Infoset, they'd be children of the doctype. In the DOM, they'd be dropped on the floor, basically.

This makes a difference for xml-stylesheet PIs.

Opera and Mozilla don't insert comments and PIs in the internal subset as children of the document.

Comment 1 Alexey Proskuryakov 2009-12-10 19:50:14 PST
What is the use case for putting xml-stylesheet PI into the internal subset?
Comment 2 Simon Pieters 2009-12-11 01:57:46 PST
No use case; that's why WebKit shouldn't allow it.
Comment 3 Lucas Forschler 2019-02-06 09:03:24 PST
Mass moving XML DOM bugs to the "DOM" Component.
Comment 4 Simon Pieters 2019-02-07 04:18:44 PST
New URL to reproduce:


says [object ProcessingInstruction] should say [object DocumentType].

<!DOCTYPE html>
...<iframe src="data:text/xml,<!DOCTYPE html [<?x?>]><html xmlns='http://www.w3.org/1999/xhtml'><script>alert(document.documentElement.previousSibling)</script></html>"> 



The xml-stylesheet should not apply but is applied.

<!DOCTYPE html>
...<iframe src="data:text/xml,<!DOCTYPE html [<?xml-stylesheet href='data:text/css,*{background:red}'?>]><html xmlns='http://www.w3.org/1999/xhtml'>There should be no red.</html>">