Merge PR #41: HTML API: Fix nested anchors in MathML text integration points

Author: sirreal

src/wp-includes/html-api/class-wp-html-processor.php

@@ -2945,15 +2945,25 @@ private function step_in_body(): bool {
 							$this->run_adoption_agency_algorithm();
 							$this->state->active_formatting_elements->remove_node( $item );
 							$is_current_node = $item === $this->state->stack_of_open_elements->current_node();
-							if ( $this->state->stack_of_open_elements->remove_node( $item ) && ! $is_current_node ) {
-								$breadcrumb_depth = count( $this->breadcrumbs );
-								while ( 0 < $breadcrumb_depth && $this->breadcrumbs[ $breadcrumb_depth - 1 ] !== $item->node_name ) {
-									--$breadcrumb_depth;
+
+							/*
+							 * The removed node's breadcrumb sits at its position in the
+							 * stack of open elements: one crumb for each open element at
+							 * or below it. Fragment parsers carry an extra crumb for the
+							 * context node, which never appears on the stack.
+							 */
+							$stack_position = 0;
+							foreach ( $this->state->stack_of_open_elements->walk_down() as $node ) {
+								++$stack_position;
+								if ( $node === $item ) {
+									break;
 								}
+							}
 
+							if ( $this->state->stack_of_open_elements->remove_node( $item ) && ! $is_current_node ) {
 								$this->non_lifo_breadcrumb_removals[] = array(
 									'token'            => $item,
-									'breadcrumb_depth' => $breadcrumb_depth,
+									'breadcrumb_depth' => isset( $this->context_node ) ? $stack_position + 1 : $stack_position,
 								);
 							}
 							break 2;

tests/phpunit/tests/html-api/wpHtmlProcessorBreadcrumbs.php

@@ -492,6 +492,51 @@ public function test_removes_outer_anchor_breadcrumb_after_mathml_text_integrati
 		);
 	}
 
+	/**
+	 * Ensures that a removed outer A element's breadcrumb is not confused with
+	 * a same-named foreign element between it and the integration point.
+	 *
+	 * Foreign A elements never participate in the active formatting elements,
+	 * so the removed node is the outer HTML A element, not the foreign one.
+	 *
+	 * @ticket 61576
+	 *
+	 * @covers WP_HTML_Processor::get_breadcrumbs
+	 * @covers WP_HTML_Processor::matches_breadcrumbs
+	 *
+	 * @dataProvider data_intervening_foreign_anchor_html
+	 *
+	 * @param string $html HTML with a foreign A element between the removed outer A element and the integration point.
+	 */
+	public function test_removes_outer_anchor_breadcrumb_with_intervening_foreign_anchor( string $html ) {
+		$processor = WP_HTML_Processor::create_fragment( $html );
+
+		$this->assertTrue( $processor->next_tag( 'SPAN' ), 'Failed to find the SPAN element after the foreign subtree.' );
+
+		$this->assertSame(
+			array( 'HTML', 'BODY', 'SPAN' ),
+			$processor->get_breadcrumbs(),
+			'The SPAN element after the foreign subtree should not remain nested inside the removed outer A element.'
+		);
+
+		$this->assertFalse(
+			$processor->matches_breadcrumbs( array( 'A', 'SPAN' ) ),
+			'The SPAN element should not match breadcrumbs inside the removed outer A element.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_intervening_foreign_anchor_html() {
+		return array(
+			'MathML A before text integration point' => array( '<a><math><a><mtext>x<a>y</a></mtext></a></math>z<span>t' ),
+			'SVG A before integration point'         => array( '<a><svg><a><foreignObject>x<a>y</a></foreignObject></a></svg>z<span>t' ),
+		);
+	}
+
 	/**
 	 * Ensures that an outer A element removed from the stack of open elements
 	 * remains visitable as a virtual closer after its existing child subtree closes.