HTML API: Derive removed anchor breadcrumb depth from stack position.

Scanning breadcrumbs by node name latched onto same-named foreign
elements (MathML or SVG A) between the removed HTML anchor and the
integration point, storing the wrong depth. The virtual closer then
never fired and the stale anchor breadcrumb persisted for the rest of
the document. Record the removed node's position in the stack of open
elements instead, accounting for the fragment parser's context crumb.

Author: sirreal

src/wp-includes/html-api/class-wp-html-processor.php

@@ -2921,15 +2921,25 @@ private function step_in_body(): bool {
 							$this->run_adoption_agency_algorithm();
 							$this->state->active_formatting_elements->remove_node( $item );
 							$is_current_node = $item === $this->state->stack_of_open_elements->current_node();
-							if ( $this->state->stack_of_open_elements->remove_node( $item ) && ! $is_current_node ) {
-								$breadcrumb_depth = count( $this->breadcrumbs );
-								while ( 0 < $breadcrumb_depth && $this->breadcrumbs[ $breadcrumb_depth - 1 ] !== $item->node_name ) {
-									--$breadcrumb_depth;
+
+							/*
+							 * The removed node's breadcrumb sits at its position in the
+							 * stack of open elements: one crumb for each open element at
+							 * or below it. Fragment parsers carry an extra crumb for the
+							 * context node, which never appears on the stack.
+							 */
+							$stack_position = 0;
+							foreach ( $this->state->stack_of_open_elements->walk_down() as $node ) {
+								++$stack_position;
+								if ( $node === $item ) {
+									break;
 								}
+							}
 
+							if ( $this->state->stack_of_open_elements->remove_node( $item ) && ! $is_current_node ) {
 								$this->non_lifo_breadcrumb_removals[] = array(
 									'token'            => $item,
-									'breadcrumb_depth' => $breadcrumb_depth,
+									'breadcrumb_depth' => isset( $this->context_node ) ? $stack_position + 1 : $stack_position,
 								);
 							}
 							break 2;

tests/phpunit/tests/html-api/wpHtmlProcessorBreadcrumbs.php

@@ -492,6 +492,51 @@ public function test_removes_outer_anchor_breadcrumb_after_mathml_text_integrati
 		);
 	}
 
+	/**
+	 * Ensures that a removed outer A element's breadcrumb is not confused with
+	 * a same-named foreign element between it and the integration point.
+	 *
+	 * Foreign A elements never participate in the active formatting elements,
+	 * so the removed node is the outer HTML A element, not the foreign one.
+	 *
+	 * @ticket 61576
+	 *
+	 * @covers WP_HTML_Processor::get_breadcrumbs
+	 * @covers WP_HTML_Processor::matches_breadcrumbs
+	 *
+	 * @dataProvider data_intervening_foreign_anchor_html
+	 *
+	 * @param string $html HTML with a foreign A element between the removed outer A element and the integration point.
+	 */
+	public function test_removes_outer_anchor_breadcrumb_with_intervening_foreign_anchor( string $html ) {
+		$processor = WP_HTML_Processor::create_fragment( $html );
+
+		$this->assertTrue( $processor->next_tag( 'SPAN' ), 'Failed to find the SPAN element after the foreign subtree.' );
+
+		$this->assertSame(
+			array( 'HTML', 'BODY', 'SPAN' ),
+			$processor->get_breadcrumbs(),
+			'The SPAN element after the foreign subtree should not remain nested inside the removed outer A element.'
+		);
+
+		$this->assertFalse(
+			$processor->matches_breadcrumbs( array( 'A', 'SPAN' ) ),
+			'The SPAN element should not match breadcrumbs inside the removed outer A element.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_intervening_foreign_anchor_html() {
+		return array(
+			'MathML A before text integration point' => array( '<a><math><a><mtext>x<a>y</a></mtext></a></math>z<span>t' ),
+			'SVG A before integration point'         => array( '<a><svg><a><foreignObject>x<a>y</a></foreignObject></a></svg>z<span>t' ),
+		);
+	}
+
 	/**
 	 * Ensures that an outer A element removed from the stack of open elements
 	 * remains visitable as a virtual closer after its existing child subtree closes.