From bb54584d9a51ab0f372332826cc144ac3eeac9fe Mon Sep 17 00:00:00 2001
From: sideshowbarker <mike@w3.org>
Date: Tue, 30 Dec 2025 10:05:46 +0900
Subject: [PATCH 1/5] =?UTF-8?q?Implement=20<select>=20parser=20=E2=80=9Cre?=
 =?UTF-8?q?laxation=E2=80=9D=20=E2=80=94=20for=20=E2=80=9Ccustomizable?=
 =?UTF-8?q?=E2=80=9D=20<select>?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This change, in order to support the “customizable” <select> element:

  - “relaxes” parsing rules in <select> (to allow more elements as children)
  - adds the <selectedcontent> element for cloning selected <option> content

ElementName.java
----------------
  - Add <selectedcontent> element with TreeBuilder.SELECTEDCONTENT group

TreeBuilder.java
----------------
  - Add SELECTEDCONTENT group constant and IN_SELECT_IN_CONTENT mode
  - Track selectedContentPointer and activeOptionStackPos for cloning
  - Allow <div>, <span>, and other elements in <select> in “relaxed” mode
  - Deep clone <option> content to <selectedcontent> when <option> closes
  - Handle <selectedcontent> special-casing (store pointer, no stack push)

SAXTreeBuilder.java
-------------------
  - Implement clearSelectedContentChildren() for clearing before clone
  - Implement deepCloneChildren() and deepCloneNode() for <option> cloning

ParentNode.java
---------------
  - Add clearChildren() method, to support clearing <selectedcontent>

html5lib-tests submodule
------------------------
  - Updated to pull in corresponding tests for “relaxed” <select> parsing
---
 .../htmlparser/impl/ElementName.java          | 142 ++---
 .../htmlparser/impl/TreeBuilder.java          | 495 ++++++++++++++++--
 .../htmlparser/sax/SAXTreeBuilder.java        |  49 ++
 src/nu/validator/saxtree/ParentNode.java      |  17 +-
 4 files changed, 603 insertions(+), 100 deletions(-)

diff --git a/src/nu/validator/htmlparser/impl/ElementName.java b/src/nu/validator/htmlparser/impl/ElementName.java
index 2d09c338..46faf362 100644
--- a/src/nu/validator/htmlparser/impl/ElementName.java
+++ b/src/nu/validator/htmlparser/impl/ElementName.java
@@ -557,6 +557,8 @@ public void destructor() {
 //                return "ANNOTATION_XML";
 //            case TreeBuilder.FOREIGNOBJECT_OR_DESC:
 //                return "FOREIGNOBJECT_OR_DESC";
+//            case TreeBuilder.SELECTEDCONTENT:
+//                return "SELECTEDCONTENT";
 //        }
 //        return null;
 //    }
@@ -1424,7 +1426,11 @@ public void destructor() {
 public static final ElementName SELECT = new ElementName("select", "select",
 // CPPONLY: NS_NewHTMLSelectElement,
 // CPPONLY: NS_NewSVGUnknownElement,
-TreeBuilder.SELECT | SPECIAL);
+TreeBuilder.SELECT | SPECIAL | SCOPING);
+public static final ElementName SELECTEDCONTENT = new ElementName("selectedcontent", "selectedcontent",
+// CPPONLY: NS_NewHTMLElement,
+// CPPONLY: NS_NewSVGUnknownElement,
+TreeBuilder.SELECTEDCONTENT);
 public static final ElementName SLOT = new ElementName("slot", "slot",
 // CPPONLY: NS_NewHTMLSlotElement,
 // CPPONLY: NS_NewSVGUnknownElement,
@@ -1484,18 +1490,18 @@ public void destructor() {
 private final static @NoLength ElementName[] ELEMENT_NAMES = {
 FIGCAPTION,
 CITE,
-FRAMESET,
+FEOFFSET,
 H1,
 CLIPPATH,
 METER,
-RADIALGRADIENT,
+SELECT,
 B,
 BGSOUND,
 SOURCE,
 DL,
 RP,
-NOFRAMES,
-MTEXT,
+PROGRESS,
+NOSCRIPT,
 VIEW,
 DIV,
 G,
@@ -1507,10 +1513,10 @@ public void destructor() {
 ANIMATETRANSFORM,
 SECTION,
 HR,
-CANVAS,
-BASEFONT,
-FEDISTANTLIGHT,
-OUTPUT,
+DEFS,
+DATALIST,
+FONT,
+PLAINTEXT,
 TFOOT,
 FEMORPHOLOGY,
 COL,
@@ -1533,14 +1539,14 @@ public void destructor() {
 VIDEO,
 BR,
 FOOTER,
-TR,
-DETAILS,
-DT,
-FOREIGNOBJECT,
-FESPOTLIGHT,
-INPUT,
-RT,
-TT,
+ADDRESS,
+MS,
+APPLET,
+FIELDSET,
+FEPOINTLIGHT,
+LINEARGRADIENT,
+OBJECT,
+RECT,
 SLOT,
 MENU,
 FECONVOLVEMATRIX,
@@ -1585,23 +1591,23 @@ public void destructor() {
 ANIMATECOLOR,
 FECOMPONENTTRANSFER,
 HEADER,
-NOBR,
-ADDRESS,
-DEFS,
-MS,
-PROGRESS,
-APPLET,
-DATALIST,
-FIELDSET,
-FEOFFSET,
-FEPOINTLIGHT,
-FONT,
-LINEARGRADIENT,
-NOSCRIPT,
-OBJECT,
-PLAINTEXT,
-RECT,
-SELECT,
+TR,
+CANVAS,
+DETAILS,
+NOFRAMES,
+DT,
+BASEFONT,
+FOREIGNOBJECT,
+FRAMESET,
+FESPOTLIGHT,
+FEDISTANTLIGHT,
+INPUT,
+MTEXT,
+RT,
+OUTPUT,
+TT,
+RADIALGRADIENT,
+SELECTEDCONTENT,
 SCRIPT,
 TEXT,
 FEDROPSHADOW,
@@ -1689,22 +1695,23 @@ public void destructor() {
 FILTER,
 FEGAUSSIANBLUR,
 MARKER,
+NOBR,
 };
 private final static int[] ELEMENT_HASHES = {
 1900845386,
 1748359220,
-2001349720,
+2001349736,
 876609538,
 1798686984,
 1971465813,
-2007781534,
+2008125638,
 59768833,
 1730965751,
 1756474198,
 1864368130,
 1938817026,
-1988763672,
-2005324101,
+1990037800,
+2005719336,
 2060065124,
 52490899,
 62390273,
@@ -1716,10 +1723,10 @@ public void destructor() {
 1881498736,
 1907661127,
 1967128578,
-1982935782,
-1999397992,
-2001392798,
-2006329158,
+1983533124,
+2000525512,
+2001495140,
+2006896969,
 2008851557,
 2085266636,
 51961587,
@@ -1742,14 +1749,14 @@ public void destructor() {
 1925844629,
 1963982850,
 1967795958,
-1973420034,
-1983633431,
-1998585858,
-2001309869,
-2001392795,
-2003183333,
-2005925890,
-2006974466,
+1982173479,
+1986527234,
+1998724870,
+2001349704,
+2001392796,
+2004635806,
+2006028454,
+2007601444,
 2008325940,
 2021937364,
 2068523856,
@@ -1794,23 +1801,23 @@ public void destructor() {
 1965334268,
 1967788867,
 1968836118,
-1971938532,
-1982173479,
-1983533124,
-1986527234,
-1990037800,
-1998724870,
-2000525512,
-2001349704,
-2001349736,
-2001392796,
-2001495140,
-2004635806,
-2005719336,
-2006028454,
-2006896969,
-2007601444,
-2008125638,
+1973420034,
+1982935782,
+1983633431,
+1988763672,
+1998585858,
+1999397992,
+2001309869,
+2001349720,
+2001392795,
+2001392798,
+2003183333,
+2005324101,
+2005925890,
+2006329158,
+2006974466,
+2007781534,
+2008305999,
 2008340774,
 2008994116,
 2051837468,
@@ -1898,5 +1905,6 @@ public void destructor() {
 1967795910,
 1968053806,
 1971461414,
+1971938532,
 };
 }
diff --git a/src/nu/validator/htmlparser/impl/TreeBuilder.java b/src/nu/validator/htmlparser/impl/TreeBuilder.java
index ba539f9c..73fc908d 100644
--- a/src/nu/validator/htmlparser/impl/TreeBuilder.java
+++ b/src/nu/validator/htmlparser/impl/TreeBuilder.java
@@ -35,6 +35,7 @@
 
 package nu.validator.htmlparser.impl;
 
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
@@ -200,6 +201,8 @@ public abstract class TreeBuilder<T> implements TokenHandler,
 
     final static int IMG = 67;
 
+    final static int SELECTEDCONTENT = 68;
+
     // start insertion modes
 
     private static final int IN_ROW = 0;
@@ -426,6 +429,25 @@ public abstract class TreeBuilder<T> implements TokenHandler,
 
     private T headPointer;
 
+    // For customizable select: tracks the selectedcontent element to clone option content into
+    protected T selectedContentPointer;
+
+    // Tracks the position in stack where selectedcontent was found
+    private int selectedContentStackPos = -1;
+
+    // Tracks if we're inside an option that should have its content cloned to selectedcontent
+    private int activeOptionStackPos = -1;
+
+    // Tracks if we've seen an option with the 'selected' attribute in the current select
+    private boolean seenSelectedOption = false;
+
+    // Tracks if we've already had an active option (first option was selected for cloning)
+    private boolean hadActiveOption = false;
+
+    // Stack to track the current parent in selectedcontent for element cloning
+    // When we're inside an active option, we push cloned elements here
+    private ArrayList<T> selectedContentCloneStack = new ArrayList<T>();
+
     protected @Auto char[] charBuffer;
 
     protected int charBufferLen = 0;
@@ -606,6 +628,11 @@ public boolean dropBufferIfLongerThan(int length) {
         listPtr = -1;
         formPointer = null;
         headPointer = null;
+        selectedContentPointer = null;
+        selectedContentStackPos = -1;
+        activeOptionStackPos = -1;
+        seenSelectedOption = false;
+        hadActiveOption = false;
         // [NOCPP[
         idLocations.clear();
         wantingComments = wantsComments();
@@ -1436,6 +1463,11 @@ public final void eof() throws SAXException {
     public final void endTokenization() throws SAXException {
         formPointer = null;
         headPointer = null;
+        selectedContentPointer = null;
+        selectedContentStackPos = -1;
+        activeOptionStackPos = -1;
+        seenSelectedOption = false;
+        hadActiveOption = false;
         contextName = null;
         contextNode = null;
         templateModeStack = null;
@@ -2169,6 +2201,23 @@ public final void startTag(ElementName elementName,
                                 attributes = null; // CPP
                                 break starttagloop;
                             case HR:
+                                // Check if select is in scope
+                                if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    // Close any open option or optgroup first
+                                    if (isCurrent("option")) {
+                                        pop();
+                                    }
+                                    if (isCurrent("optgroup")) {
+                                        pop();
+                                    }
+                                    appendVoidElementToCurrent(elementName, attributes);
+                                    selfClosing = false;
+                                    // [NOCPP[
+                                    voidElement = true;
+                                    // ]NOCPP]
+                                    attributes = null; // CPP
+                                    break starttagloop;
+                                }
                                 implicitlyCloseP();
                                 appendVoidElementToCurrentMayFoster(
                                         elementName,
@@ -2184,7 +2233,27 @@ public final void startTag(ElementName elementName,
                                 elementName = ElementName.IMG;
                                 continue starttagloop;
                             case IMG:
+                                reconstructTheActiveFormattingElements();
+                                appendVoidElementToCurrentMayFoster(
+                                        elementName, attributes,
+                                        formPointer);
+                                selfClosing = false;
+                                // [NOCPP[
+                                voidElement = true;
+                                // ]NOCPP]
+                                attributes = null; // CPP
+                                break starttagloop;
                             case INPUT:
+                                // Check if select is in scope and close it (for compatibility)
+                                eltPos = findLastInScope("select");
+                                if (eltPos != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    errStartTagWithSelectOpen(name);
+                                    while (currentPtr >= eltPos) {
+                                        pop();
+                                    }
+                                    resetTheInsertionMode();
+                                    continue starttagloop;
+                                }
                                 reconstructTheActiveFormattingElements();
                                 appendVoidElementToCurrentMayFoster(
                                         elementName, attributes,
@@ -2196,6 +2265,16 @@ public final void startTag(ElementName elementName,
                                 attributes = null; // CPP
                                 break starttagloop;
                             case TEXTAREA:
+                                // Check if select is in scope and close it (for compatibility)
+                                eltPos = findLastInScope("select");
+                                if (eltPos != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    errStartTagWithSelectOpen(name);
+                                    while (currentPtr >= eltPos) {
+                                        pop();
+                                    }
+                                    resetTheInsertionMode();
+                                    continue starttagloop;
+                                }
                                 appendToCurrentNodeAndPushElementMayFoster(
                                         elementName,
                                         attributes, formPointer);
@@ -2235,27 +2314,110 @@ public final void startTag(ElementName elementName,
                                 attributes = null; // CPP
                                 break starttagloop;
                             case SELECT:
+                                // Check if select is already in scope (nested select)
+                                eltPos = findLastInScope(name);
+                                if (eltPos != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    // Nested select acts like </select> - close the existing one
+                                    // but do NOT insert a new select element
+                                    errStartSelectWhereEndSelectExpected();
+                                    generateImpliedEndTags();
+                                    if (errorHandler != null
+                                            && !isCurrent(name)) {
+                                        errUnclosedElementsImplied(eltPos, name);
+                                    }
+                                    while (currentPtr >= eltPos) {
+                                        pop();
+                                    }
+                                    resetTheInsertionMode();
+                                    break starttagloop;
+                                } else {
+                                    reconstructTheActiveFormattingElements();
+                                    appendToCurrentNodeAndPushElementMayFoster(
+                                            elementName,
+                                            attributes, formPointer);
+                                    // No longer switch to IN_SELECT mode
+                                    attributes = null; // CPP
+                                    break starttagloop;
+                                }
+                            case OPTION:
+                                // Check if select is in scope
+                                if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    // Reconstruct active formatting elements first
+                                    reconstructTheActiveFormattingElements();
+                                    // Generate implied end tags except for optgroup
+                                    generateImpliedEndTagsExceptFor("optgroup");
+                                    // Check if option is in scope and close it
+                                    eltPos = findLastInScope("option");
+                                    if (eltPos != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                        if (errorHandler != null && !isCurrent("option")) {
+                                            errUnclosedElementsImplied(eltPos, "option");
+                                        }
+                                        while (currentPtr >= eltPos) {
+                                            pop();
+                                        }
+                                    }
+                                    // Check if this option should be active for selectedcontent cloning
+                                    boolean hasSelected = attributes.contains(AttributeName.SELECTED);
+                                    boolean shouldBeActive = false;
+                                    if (selectedContentPointer != null) {
+                                        if (hasSelected) {
+                                            // Option with selected attr becomes active
+                                            // Clear previous selectedcontent content if we had a different active option
+                                            if (hadActiveOption && !seenSelectedOption) {
+                                                clearSelectedContentChildren();
+                                            }
+                                            seenSelectedOption = true;
+                                            shouldBeActive = true;
+                                        } else if (!seenSelectedOption && !hadActiveOption) {
+                                            // First option without selected - tentatively active
+                                            shouldBeActive = true;
+                                        }
+                                    }
+                                    appendToCurrentNodeAndPushElement(
+                                            elementName,
+                                            attributes);
+                                    if (shouldBeActive) {
+                                        activeOptionStackPos = currentPtr;
+                                        hadActiveOption = true;
+                                        // Initialize the clone stack with selectedcontent as the root parent
+                                        selectedContentCloneStack.clear();
+                                        selectedContentCloneStack.add(selectedContentPointer);
+                                    }
+                                    attributes = null; // CPP
+                                    break starttagloop;
+                                }
+                                // Outside select, fall through to old behavior
+                                if (isCurrent("option")) {
+                                    pop();
+                                }
                                 reconstructTheActiveFormattingElements();
                                 appendToCurrentNodeAndPushElementMayFoster(
                                         elementName,
-                                        attributes, formPointer);
-                                switch (mode) {
-                                    case IN_TABLE:
-                                    case IN_CAPTION:
-                                    case IN_COLUMN_GROUP:
-                                    case IN_TABLE_BODY:
-                                    case IN_ROW:
-                                    case IN_CELL:
-                                        mode = IN_SELECT_IN_TABLE;
-                                        break;
-                                    default:
-                                        mode = IN_SELECT;
-                                        break;
-                                }
+                                        attributes);
                                 attributes = null; // CPP
                                 break starttagloop;
                             case OPTGROUP:
-                            case OPTION:
+                                // Check if select is in scope
+                                if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    // Generate implied end tags
+                                    generateImpliedEndTags();
+                                    // Check if optgroup is in scope and close it
+                                    eltPos = findLastInScope("optgroup");
+                                    if (eltPos != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                        if (errorHandler != null && !isCurrent("optgroup")) {
+                                            errUnclosedElementsImplied(eltPos, "optgroup");
+                                        }
+                                        while (currentPtr >= eltPos) {
+                                            pop();
+                                        }
+                                    }
+                                    appendToCurrentNodeAndPushElement(
+                                            elementName,
+                                            attributes);
+                                    attributes = null; // CPP
+                                    break starttagloop;
+                                }
+                                // Outside select, fall through to old behavior
                                 if (isCurrent("option")) {
                                     pop();
                                 }
@@ -2329,11 +2491,25 @@ public final void startTag(ElementName elementName,
                                 attributes = null; // CPP
                                 break starttagloop;
                             case CAPTION:
-                            case COL:
-                            case COLGROUP:
                             case TBODY_OR_THEAD_OR_TFOOT:
                             case TR:
                             case TD_OR_TH:
+                                // Check if we're inside a select inside a table
+                                // If so, close the select and reprocess
+                                if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK
+                                        && findLastInTableScope("table") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    errStartTagWithSelectOpen(name);
+                                    eltPos = findLastInScope("select");
+                                    while (currentPtr >= eltPos) {
+                                        pop();
+                                    }
+                                    resetTheInsertionMode();
+                                    continue starttagloop;
+                                }
+                                errStrayStartTag(name);
+                                break starttagloop;
+                            case COL:
+                            case COLGROUP:
                             case FRAME:
                             case FRAMESET:
                             case HEAD:
@@ -2346,6 +2522,26 @@ public final void startTag(ElementName elementName,
                                         attributes, formPointer);
                                 attributes = null; // CPP
                                 break starttagloop;
+                            case SELECTEDCONTENT:
+                                // Track selectedcontent for cloning option content
+                                if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    reconstructTheActiveFormattingElements();
+                                    appendToCurrentNodeAndPushElement(
+                                            elementName,
+                                            attributes);
+                                    // Save pointer for content cloning
+                                    selectedContentPointer = stack[currentPtr].node;
+                                    selectedContentStackPos = currentPtr;
+                                    attributes = null; // CPP
+                                    break starttagloop;
+                                }
+                                // Outside select, treat as normal element
+                                reconstructTheActiveFormattingElements();
+                                appendToCurrentNodeAndPushElementMayFoster(
+                                        elementName,
+                                        attributes);
+                                attributes = null; // CPP
+                                break starttagloop;
                             default:
                                 reconstructTheActiveFormattingElements();
                                 appendToCurrentNodeAndPushElementMayFoster(
@@ -3627,6 +3823,51 @@ public final void endTag(ElementName elementName) throws SAXException {
                                 }
                             }
                             break endtagloop;
+                        case OPTION:
+                            // Handle option end tag when select is in scope
+                            if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                eltPos = findLastInScope("option");
+                                if (eltPos == TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    errStrayEndTag(name);
+                                } else {
+                                    generateImpliedEndTagsExceptFor("option");
+                                    if (errorHandler != null && !isCurrent("option")) {
+                                        errUnclosedElements(eltPos, name);
+                                    }
+                                    while (currentPtr >= eltPos) {
+                                        pop();
+                                    }
+                                }
+                                break endtagloop;
+                            }
+                            // Outside select, treat as stray end tag
+                            errStrayEndTag(name);
+                            break endtagloop;
+                        case OPTGROUP:
+                            // Handle optgroup end tag when select is in scope
+                            if (findLastInScope("select") != TreeBuilder.NOT_FOUND_ON_STACK) {
+                                // If current node is option and previous is optgroup, close option first
+                                if (isCurrent("option") && currentPtr >= 1
+                                        && "optgroup" == stack[currentPtr - 1].name) {
+                                    pop();
+                                }
+                                eltPos = findLastInScope("optgroup");
+                                if (eltPos == TreeBuilder.NOT_FOUND_ON_STACK) {
+                                    errStrayEndTag(name);
+                                } else {
+                                    generateImpliedEndTagsExceptFor("optgroup");
+                                    if (errorHandler != null && !isCurrent("optgroup")) {
+                                        errUnclosedElements(eltPos, name);
+                                    }
+                                    while (currentPtr >= eltPos) {
+                                        pop();
+                                    }
+                                }
+                                break endtagloop;
+                            }
+                            // Outside select, treat as stray end tag
+                            errStrayEndTag(name);
+                            break endtagloop;
                         case H1_OR_H2_OR_H3_OR_H4_OR_H5_OR_H6:
                             eltPos = findLastInScopeHn();
                             if (eltPos == TreeBuilder.NOT_FOUND_ON_STACK) {
@@ -3674,6 +3915,22 @@ public final void endTag(ElementName elementName) throws SAXException {
                         case TEMPLATE:
                             // fall through to IN_HEAD;
                             break;
+                        case SELECT:
+                            // Handle select end tag when select is in scope
+                            eltPos = findLastInScope("select");
+                            if (eltPos == TreeBuilder.NOT_FOUND_ON_STACK) {
+                                errStrayEndTag(name);
+                                break endtagloop;
+                            }
+                            generateImpliedEndTags();
+                            if (errorHandler != null && !isCurrent("select")) {
+                                errUnclosedElements(eltPos, name);
+                            }
+                            while (currentPtr >= eltPos) {
+                                pop();
+                            }
+                            resetTheInsertionMode();
+                            break endtagloop;
                         case AREA_OR_WBR:
                         case KEYGEN: // XXX??
                         case PARAM_OR_SOURCE_OR_TRACK:
@@ -3685,7 +3942,6 @@ public final void endTag(ElementName elementName) throws SAXException {
                         case IFRAME:
                         case NOEMBED: // XXX???
                         case NOFRAMES: // XXX??
-                        case SELECT:
                         case TABLE:
                         case TEXTAREA: // XXX??
                             errStrayEndTag(name);
@@ -4321,20 +4577,9 @@ private void resetTheInsertionMode() {
                 }
             }
             if ("select" == name) {
-                int ancestorIndex = i;
-                while (ancestorIndex > 0) {
-                    StackNode<T> ancestor = stack[ancestorIndex--];
-                    if ("http://www.w3.org/1999/xhtml" == ancestor.ns) {
-                        if ("template" == ancestor.name) {
-                            break;
-                        }
-                        if ("table" == ancestor.name) {
-                            mode = IN_SELECT_IN_TABLE;
-                            return;
-                        }
-                    }
-                }
-                mode = IN_SELECT;
+                // With select parser relaxation, we no longer enter IN_SELECT mode
+                // Instead, stay in IN_BODY mode and handle select content there
+                mode = framesetOk ? FRAMESET_OK : IN_BODY;
                 return;
             } else if ("td" == name || "th" == name) {
                 mode = IN_CELL;
@@ -5097,6 +5342,29 @@ private void popTemplateMode() {
     private void pop() throws SAXException {
         StackNode<T> node = stack[currentPtr];
         assert debugOnlyClearLastStackSlot();
+        // When active option closes, deep-clone its content to selectedcontent
+        // This handles adoption agency restructuring correctly
+        if (currentPtr == activeOptionStackPos) {
+            if (selectedContentPointer != null) {
+                clearSelectedContentChildren();
+                deepCloneChildren(node.node, selectedContentPointer);
+            }
+            activeOptionStackPos = -1;
+            selectedContentCloneStack.clear();
+        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
+            // Pop from clone stack when popping an element inside active option
+            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
+        }
+        // Clear selectedcontent tracking if we're popping the select element
+        // (not when popping selectedcontent itself - the DOM node is still valid)
+        if (node.getGroup() == SELECT) {
+            selectedContentPointer = null;
+            selectedContentStackPos = -1;
+            seenSelectedOption = false;
+            activeOptionStackPos = -1;
+            hadActiveOption = false;
+            selectedContentCloneStack.clear();
+        }
         currentPtr--;
         elementPopped(node.ns, node.popName, node.node);
         node.release(this);
@@ -5108,6 +5376,27 @@ private void popForeign(int origPos, int eltPos) throws SAXException {
             markMalformedIfScript(node.node);
         }
         assert debugOnlyClearLastStackSlot();
+        // When active option closes, deep-clone its content to selectedcontent
+        if (currentPtr == activeOptionStackPos) {
+            if (selectedContentPointer != null) {
+                clearSelectedContentChildren();
+                deepCloneChildren(node.node, selectedContentPointer);
+            }
+            activeOptionStackPos = -1;
+            selectedContentCloneStack.clear();
+        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
+            // Pop from clone stack when popping an element inside active option
+            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
+        }
+        // Clear selectedcontent tracking if we're popping the select element
+        if (node.getGroup() == SELECT) {
+            selectedContentPointer = null;
+            selectedContentStackPos = -1;
+            seenSelectedOption = false;
+            activeOptionStackPos = -1;
+            hadActiveOption = false;
+            selectedContentCloneStack.clear();
+        }
         currentPtr--;
         elementPopped(node.ns, node.popName, node.node);
         node.release(this);
@@ -5116,6 +5405,27 @@ private void popForeign(int origPos, int eltPos) throws SAXException {
     private void silentPop() throws SAXException {
         StackNode<T> node = stack[currentPtr];
         assert debugOnlyClearLastStackSlot();
+        // When active option closes, deep-clone its content to selectedcontent
+        if (currentPtr == activeOptionStackPos) {
+            if (selectedContentPointer != null) {
+                clearSelectedContentChildren();
+                deepCloneChildren(node.node, selectedContentPointer);
+            }
+            activeOptionStackPos = -1;
+            selectedContentCloneStack.clear();
+        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
+            // Pop from clone stack when popping an element inside active option
+            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
+        }
+        // Clear selectedcontent tracking if we're popping the select element
+        if (node.getGroup() == SELECT) {
+            selectedContentPointer = null;
+            selectedContentStackPos = -1;
+            seenSelectedOption = false;
+            activeOptionStackPos = -1;
+            hadActiveOption = false;
+            selectedContentCloneStack.clear();
+        }
         currentPtr--;
         node.release(this);
     }
@@ -5123,6 +5433,27 @@ private void silentPop() throws SAXException {
     private void popOnEof() throws SAXException {
         StackNode<T> node = stack[currentPtr];
         assert debugOnlyClearLastStackSlot();
+        // When active option closes, deep-clone its content to selectedcontent
+        if (currentPtr == activeOptionStackPos) {
+            if (selectedContentPointer != null) {
+                clearSelectedContentChildren();
+                deepCloneChildren(node.node, selectedContentPointer);
+            }
+            activeOptionStackPos = -1;
+            selectedContentCloneStack.clear();
+        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
+            // Pop from clone stack when popping an element inside active option
+            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
+        }
+        // Clear selectedcontent tracking if we're popping the select element
+        if (node.getGroup() == SELECT) {
+            selectedContentPointer = null;
+            selectedContentStackPos = -1;
+            seenSelectedOption = false;
+            activeOptionStackPos = -1;
+            hadActiveOption = false;
+            selectedContentCloneStack.clear();
+        }
         currentPtr--;
         markMalformedIfScript(node.node);
         elementPopped(node.ns, node.popName, node.node);
@@ -5312,6 +5643,8 @@ private void appendToCurrentNodeAndPushFormattingElementMayFoster(
         // ]NOCPP]
         // This method can't be called for custom elements
         HtmlAttributes clone = attributes.cloneAttributes();
+        // Clone to selectedcontent if inside active option (must be before createElement due to C++ attribute ownership)
+        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", elementName.getName(), attributes);
         // Attributes must not be read after calling createElement, because
         // createElement may delete attributes in C++.
         T elt;
@@ -5361,6 +5694,8 @@ private void appendToCurrentNodeAndPushElement(ElementName elementName,
         } else {
             appendElement(elt, currentNode);
         }
+        // Clone to selectedcontent if inside active option
+        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", elementName.getName(), attributes);
         StackNode<T> node = createStackNode(elementName, elt
                 // [NOCPP[
                 , errorHandler == null ? null : new TaintableLocatorImpl(tokenizer)
@@ -5393,6 +5728,8 @@ private void appendToCurrentNodeAndPushElementMayFoster(ElementName elementName,
                     );
             appendElement(elt, currentNode);
         }
+        // Clone to selectedcontent if inside active option
+        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", popName, attributes);
         StackNode<T> node = createStackNode(elementName, elt, popName
                 // [NOCPP[
                 , errorHandler == null ? null : new TaintableLocatorImpl(tokenizer)
@@ -5416,6 +5753,8 @@ private void appendToCurrentNodeAndPushElementMayFosterMathML(
                 && annotationXmlEncodingPermitsHtml(attributes)) {
             markAsHtmlIntegrationPoint = true;
         }
+        // Clone to selectedcontent if inside active option (must be before createElement due to C++ attribute ownership)
+        cloneElementToSelectedContent("http://www.w3.org/1998/Math/MathML", popName, attributes);
         // Attributes must not be read after calling createElement(), since
         // createElement may delete the object in C++.
         T elt;
@@ -5481,6 +5820,8 @@ private void appendToCurrentNodeAndPushElementMayFosterSVG(
             popName = checkPopName(popName);
         }
         // ]NOCPP]
+        // Clone to selectedcontent if inside active option
+        cloneElementToSelectedContent("http://www.w3.org/2000/svg", popName, attributes);
         T elt;
         StackNode<T> current = stack[currentPtr];
         if (current.isFosterParenting()) {
@@ -5510,6 +5851,8 @@ private void appendToCurrentNodeAndPushElementMayFoster(ElementName elementName,
         checkAttributes(attributes, "http://www.w3.org/1999/xhtml");
         // ]NOCPP]
         // Can't be called for custom elements
+        // Clone to selectedcontent if inside active option
+        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", elementName.getName(), attributes);
         T elt;
         T formOwner = form == null || fragment || isTemplateContents() ? null : form;
         StackNode<T> current = stack[currentPtr];
@@ -5698,6 +6041,55 @@ private void appendVoidFormToCurrent(HtmlAttributes attributes) throws SAXExcept
         elementPopped("http://www.w3.org/1999/xhtml", "form", elt);
     }
 
+    /**
+     * Clones an element to the selectedcontent hierarchy when inside an active option.
+     * This is used for the customizable select feature.
+     *
+     * @param ns The namespace URI
+     * @param name The element name
+     * @param attributes The attributes (will be cloned)
+     */
+    private void cloneElementToSelectedContent(@NsUri String ns, @Local String name,
+            HtmlAttributes attributes) throws SAXException {
+        if (activeOptionStackPos < 0 || selectedContentCloneStack.isEmpty()) {
+            return;
+        }
+        // Clone the attributes
+        HtmlAttributes clonedAttrs = attributes.cloneAttributes();
+        // Get the current parent in the selectedcontent hierarchy
+        T selectedContentParent = selectedContentCloneStack.get(selectedContentCloneStack.size() - 1);
+        // Create a clone element
+        T clone = createElement(ns, name, clonedAttrs, selectedContentParent
+                // CPPONLY: , htmlCreator(null)
+                );
+        // Append the clone to the selectedcontent parent
+        appendElement(clone, selectedContentParent);
+        // Push the clone to the stack so nested content goes into it
+        selectedContentCloneStack.add(clone);
+    }
+
+    /**
+     * Clones a void element to the selectedcontent hierarchy when inside an active option.
+     * Void elements don't need to be pushed to the stack since they have no children.
+     */
+    private void cloneVoidElementToSelectedContent(@NsUri String ns, @Local String name,
+            HtmlAttributes attributes) throws SAXException {
+        if (activeOptionStackPos < 0 || selectedContentCloneStack.isEmpty()) {
+            return;
+        }
+        // Clone the attributes
+        HtmlAttributes clonedAttrs = attributes.cloneAttributes();
+        // Get the current parent in the selectedcontent hierarchy
+        T selectedContentParent = selectedContentCloneStack.get(selectedContentCloneStack.size() - 1);
+        // Create a clone element
+        T clone = createElement(ns, name, clonedAttrs, selectedContentParent
+                // CPPONLY: , htmlCreator(null)
+                );
+        // Append the clone to the selectedcontent parent
+        appendElement(clone, selectedContentParent);
+        // Void elements don't need to be pushed to the stack
+    }
+
     // [NOCPP[
 
     private final void accumulateCharactersForced(@Const @NoLength char[] buf,
@@ -5733,6 +6125,10 @@ private final void accumulateCharactersForced(@Const @NoLength char[] buf,
     protected void accumulateCharacters(@Const @NoLength char[] buf, int start,
             int length) throws SAXException {
         appendCharacters(stack[currentPtr].node, buf, start, length);
+        // Also clone to selectedcontent if in active option
+        if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
+            appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), buf, start, length);
+        }
     }
 
     // ------------------------------- //
@@ -5760,6 +6156,15 @@ protected abstract T createHtmlElementSetAsRoot(HtmlAttributes attributes)
 
     protected abstract void detachFromParent(T element) throws SAXException;
 
+    /**
+     * Deep clones the children of the source element to the destination element.
+     * Used for cloning option content to selectedcontent.
+     * Default implementation does nothing. Subclasses should override.
+     */
+    protected void deepCloneChildren(T source, T destination) throws SAXException {
+        // Default implementation does nothing
+    }
+
     protected abstract boolean hasChildren(T element) throws SAXException;
 
     protected abstract void appendElement(T child, T newParent)
@@ -5803,6 +6208,16 @@ protected abstract void appendCommentToDocument(@NoLength char[] buf,
     protected abstract void addAttributesToElement(T element,
             HtmlAttributes attributes) throws SAXException;
 
+    /**
+     * Clears all children from the selectedcontent element.
+     * Used when an option with 'selected' attribute is seen after
+     * content has already been cloned from a previous option.
+     */
+    protected void clearSelectedContentChildren() throws SAXException {
+        // Default implementation does nothing. Subclasses that support
+        // selectedcontent cloning can override this.
+    }
+
     protected void markMalformedIfScript(T elt) throws SAXException {
 
     }
@@ -6008,6 +6423,10 @@ && charBufferContainsNonWhitespace()) {
                     // reconstructing gave us a new current node
                     appendCharacters(currentNode(), charBuffer, 0,
                             charBufferLen);
+                    // Also clone to selectedcontent if in active option
+                    if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
+                        appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
+                    }
                     charBufferLen = 0;
                     return;
                 }
@@ -6017,6 +6436,10 @@ && charBufferContainsNonWhitespace()) {
 
                 if (templatePos >= tablePos) {
                     appendCharacters(stack[templatePos].node, charBuffer, 0, charBufferLen);
+                    // Also clone to selectedcontent if in active option
+                    if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
+                        appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
+                    }
                     charBufferLen = 0;
                     return;
                 }
@@ -6024,10 +6447,18 @@ && charBufferContainsNonWhitespace()) {
                 StackNode<T> tableElt = stack[tablePos];
                 insertFosterParentedCharacters(charBuffer, 0, charBufferLen,
                         tableElt.node, stack[tablePos - 1].node);
+                // Also clone to selectedcontent if in active option
+                if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
+                    appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
+                }
                 charBufferLen = 0;
                 return;
             }
             appendCharacters(currentNode(), charBuffer, 0, charBufferLen);
+            // Also clone to selectedcontent if in active option
+            if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
+                appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
+            }
             charBufferLen = 0;
         }
     }
diff --git a/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java b/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
index a085ec8d..248a5015 100644
--- a/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
+++ b/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
@@ -34,6 +34,7 @@
 import nu.validator.saxtree.DocumentFragment;
 import nu.validator.saxtree.Element;
 import nu.validator.saxtree.Node;
+import nu.validator.saxtree.NodeType;
 import nu.validator.saxtree.ParentNode;
 
 class SAXTreeBuilder extends TreeBuilder<Element> {
@@ -197,4 +198,52 @@ private Node previousSibling(Node table) {
             throws SAXException {
         element.detach();
     }
+
+    @Override
+    protected void clearSelectedContentChildren() throws SAXException {
+        if (selectedContentPointer != null) {
+            ((ParentNode) selectedContentPointer).clearChildren();
+        }
+    }
+
+    @Override
+    protected void deepCloneChildren(Element source, Element destination) throws SAXException {
+        Node child = source.getFirstChild();
+        while (child != null) {
+            deepCloneNode(child, destination);
+            child = child.getNextSibling();
+        }
+    }
+
+    private void deepCloneNode(Node node, ParentNode destination) throws SAXException {
+        switch (node.getNodeType()) {
+            case ELEMENT:
+                Element srcElem = (Element) node;
+                // Create a clone element with copied attributes
+                Element cloneElem = new Element(null,
+                        srcElem.getUri(),
+                        srcElem.getLocalName(),
+                        srcElem.getQName(),
+                        srcElem.getAttributes(),
+                        false,  // copy attributes
+                        srcElem.getPrefixMappings());
+                destination.appendChild(cloneElem);
+                // Recursively clone children
+                Node child = srcElem.getFirstChild();
+                while (child != null) {
+                    deepCloneNode(child, cloneElem);
+                    child = child.getNextSibling();
+                }
+                break;
+            case CHARACTERS:
+                // Clone the characters
+                String text = node.toString();
+                Characters cloneChars = new Characters(null, text.toCharArray(), 0, text.length());
+                destination.appendChild(cloneChars);
+                break;
+            default:
+                // Ignore other node types for now
+                break;
+        }
+    }
 }
diff --git a/src/nu/validator/saxtree/ParentNode.java b/src/nu/validator/saxtree/ParentNode.java
index 6cc96003..b72acee9 100644
--- a/src/nu/validator/saxtree/ParentNode.java
+++ b/src/nu/validator/saxtree/ParentNode.java
@@ -202,7 +202,22 @@ void removeChild(Node node) {
             prev.setNextSibling(node.getNextSibling());
             if (lastChild == node) {
                 lastChild = prev;
-            }            
+            }
+        }
+    }
+
+    /**
+     * Remove all children from this node.
+     */
+    public void clearChildren() {
+        Node child = firstChild;
+        while (child != null) {
+            Node next = child.getNextSibling();
+            child.setParentNode(null);
+            child.setNextSibling(null);
+            child = next;
         }
+        firstChild = null;
+        lastChild = null;
     }
 }

From 638e4c090320fb858350b535e86fe839f8760018 Mon Sep 17 00:00:00 2001
From: sideshowbarker <mike@w3.org>
Date: Mon, 2 Feb 2026 02:44:55 +0900
Subject: [PATCH 2/5] Replace inline cloning with option-pop hook for
 <selectedcontent>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The initial implementation did inline cloning during parsing (mirroring
elements/characters into <selectedcontent> as tokens were processed) AND
deep-cloned from the DOM when option was popped.

The inline cloning was wrong per spec — cloning should operate on the
DOM, not on what the parser saw (the adoption agency algorithm can
restructure the tree) — and redundant, since pop() cleared
<selectedcontent> and deep-cloned from the DOM anyway.

This replaces all inline cloning machinery with a single overridable
hook method, cloneOptionContentToSelectedContent(), called when <option>
is popped. The tree builder tracks which <option> is active and where
<selectedcontent> is, but delegates the actual DOM cloning to subclasses.
---
 .../htmlparser/impl/TreeBuilder.java          | 147 ++----------------
 .../htmlparser/sax/SAXTreeBuilder.java        |  11 +-
 2 files changed, 16 insertions(+), 142 deletions(-)

diff --git a/src/nu/validator/htmlparser/impl/TreeBuilder.java b/src/nu/validator/htmlparser/impl/TreeBuilder.java
index 73fc908d..9a51d331 100644
--- a/src/nu/validator/htmlparser/impl/TreeBuilder.java
+++ b/src/nu/validator/htmlparser/impl/TreeBuilder.java
@@ -35,7 +35,6 @@
 
 package nu.validator.htmlparser.impl;
 
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
@@ -444,10 +443,6 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     // Tracks if we've already had an active option (first option was selected for cloning)
     private boolean hadActiveOption = false;
 
-    // Stack to track the current parent in selectedcontent for element cloning
-    // When we're inside an active option, we push cloned elements here
-    private ArrayList<T> selectedContentCloneStack = new ArrayList<T>();
-
     protected @Auto char[] charBuffer;
 
     protected int charBufferLen = 0;
@@ -2362,10 +2357,6 @@ public final void startTag(ElementName elementName,
                                     if (selectedContentPointer != null) {
                                         if (hasSelected) {
                                             // Option with selected attr becomes active
-                                            // Clear previous selectedcontent content if we had a different active option
-                                            if (hadActiveOption && !seenSelectedOption) {
-                                                clearSelectedContentChildren();
-                                            }
                                             seenSelectedOption = true;
                                             shouldBeActive = true;
                                         } else if (!seenSelectedOption && !hadActiveOption) {
@@ -2379,9 +2370,6 @@ public final void startTag(ElementName elementName,
                                     if (shouldBeActive) {
                                         activeOptionStackPos = currentPtr;
                                         hadActiveOption = true;
-                                        // Initialize the clone stack with selectedcontent as the root parent
-                                        selectedContentCloneStack.clear();
-                                        selectedContentCloneStack.add(selectedContentPointer);
                                     }
                                     attributes = null; // CPP
                                     break starttagloop;
@@ -5346,14 +5334,9 @@ private void pop() throws SAXException {
         // This handles adoption agency restructuring correctly
         if (currentPtr == activeOptionStackPos) {
             if (selectedContentPointer != null) {
-                clearSelectedContentChildren();
-                deepCloneChildren(node.node, selectedContentPointer);
+                cloneOptionContentToSelectedContent(node.node, selectedContentPointer);
             }
             activeOptionStackPos = -1;
-            selectedContentCloneStack.clear();
-        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
-            // Pop from clone stack when popping an element inside active option
-            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
         }
         // Clear selectedcontent tracking if we're popping the select element
         // (not when popping selectedcontent itself - the DOM node is still valid)
@@ -5363,7 +5346,6 @@ private void pop() throws SAXException {
             seenSelectedOption = false;
             activeOptionStackPos = -1;
             hadActiveOption = false;
-            selectedContentCloneStack.clear();
         }
         currentPtr--;
         elementPopped(node.ns, node.popName, node.node);
@@ -5379,14 +5361,9 @@ private void popForeign(int origPos, int eltPos) throws SAXException {
         // When active option closes, deep-clone its content to selectedcontent
         if (currentPtr == activeOptionStackPos) {
             if (selectedContentPointer != null) {
-                clearSelectedContentChildren();
-                deepCloneChildren(node.node, selectedContentPointer);
+                cloneOptionContentToSelectedContent(node.node, selectedContentPointer);
             }
             activeOptionStackPos = -1;
-            selectedContentCloneStack.clear();
-        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
-            // Pop from clone stack when popping an element inside active option
-            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
         }
         // Clear selectedcontent tracking if we're popping the select element
         if (node.getGroup() == SELECT) {
@@ -5395,7 +5372,6 @@ private void popForeign(int origPos, int eltPos) throws SAXException {
             seenSelectedOption = false;
             activeOptionStackPos = -1;
             hadActiveOption = false;
-            selectedContentCloneStack.clear();
         }
         currentPtr--;
         elementPopped(node.ns, node.popName, node.node);
@@ -5408,14 +5384,9 @@ private void silentPop() throws SAXException {
         // When active option closes, deep-clone its content to selectedcontent
         if (currentPtr == activeOptionStackPos) {
             if (selectedContentPointer != null) {
-                clearSelectedContentChildren();
-                deepCloneChildren(node.node, selectedContentPointer);
+                cloneOptionContentToSelectedContent(node.node, selectedContentPointer);
             }
             activeOptionStackPos = -1;
-            selectedContentCloneStack.clear();
-        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
-            // Pop from clone stack when popping an element inside active option
-            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
         }
         // Clear selectedcontent tracking if we're popping the select element
         if (node.getGroup() == SELECT) {
@@ -5424,7 +5395,6 @@ private void silentPop() throws SAXException {
             seenSelectedOption = false;
             activeOptionStackPos = -1;
             hadActiveOption = false;
-            selectedContentCloneStack.clear();
         }
         currentPtr--;
         node.release(this);
@@ -5436,14 +5406,9 @@ private void popOnEof() throws SAXException {
         // When active option closes, deep-clone its content to selectedcontent
         if (currentPtr == activeOptionStackPos) {
             if (selectedContentPointer != null) {
-                clearSelectedContentChildren();
-                deepCloneChildren(node.node, selectedContentPointer);
+                cloneOptionContentToSelectedContent(node.node, selectedContentPointer);
             }
             activeOptionStackPos = -1;
-            selectedContentCloneStack.clear();
-        } else if (activeOptionStackPos >= 0 && currentPtr > activeOptionStackPos && selectedContentCloneStack.size() > 1) {
-            // Pop from clone stack when popping an element inside active option
-            selectedContentCloneStack.remove(selectedContentCloneStack.size() - 1);
         }
         // Clear selectedcontent tracking if we're popping the select element
         if (node.getGroup() == SELECT) {
@@ -5452,7 +5417,6 @@ private void popOnEof() throws SAXException {
             seenSelectedOption = false;
             activeOptionStackPos = -1;
             hadActiveOption = false;
-            selectedContentCloneStack.clear();
         }
         currentPtr--;
         markMalformedIfScript(node.node);
@@ -5643,8 +5607,6 @@ private void appendToCurrentNodeAndPushFormattingElementMayFoster(
         // ]NOCPP]
         // This method can't be called for custom elements
         HtmlAttributes clone = attributes.cloneAttributes();
-        // Clone to selectedcontent if inside active option (must be before createElement due to C++ attribute ownership)
-        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", elementName.getName(), attributes);
         // Attributes must not be read after calling createElement, because
         // createElement may delete attributes in C++.
         T elt;
@@ -5694,8 +5656,6 @@ private void appendToCurrentNodeAndPushElement(ElementName elementName,
         } else {
             appendElement(elt, currentNode);
         }
-        // Clone to selectedcontent if inside active option
-        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", elementName.getName(), attributes);
         StackNode<T> node = createStackNode(elementName, elt
                 // [NOCPP[
                 , errorHandler == null ? null : new TaintableLocatorImpl(tokenizer)
@@ -5728,8 +5688,6 @@ private void appendToCurrentNodeAndPushElementMayFoster(ElementName elementName,
                     );
             appendElement(elt, currentNode);
         }
-        // Clone to selectedcontent if inside active option
-        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", popName, attributes);
         StackNode<T> node = createStackNode(elementName, elt, popName
                 // [NOCPP[
                 , errorHandler == null ? null : new TaintableLocatorImpl(tokenizer)
@@ -5753,8 +5711,6 @@ private void appendToCurrentNodeAndPushElementMayFosterMathML(
                 && annotationXmlEncodingPermitsHtml(attributes)) {
             markAsHtmlIntegrationPoint = true;
         }
-        // Clone to selectedcontent if inside active option (must be before createElement due to C++ attribute ownership)
-        cloneElementToSelectedContent("http://www.w3.org/1998/Math/MathML", popName, attributes);
         // Attributes must not be read after calling createElement(), since
         // createElement may delete the object in C++.
         T elt;
@@ -5820,8 +5776,6 @@ private void appendToCurrentNodeAndPushElementMayFosterSVG(
             popName = checkPopName(popName);
         }
         // ]NOCPP]
-        // Clone to selectedcontent if inside active option
-        cloneElementToSelectedContent("http://www.w3.org/2000/svg", popName, attributes);
         T elt;
         StackNode<T> current = stack[currentPtr];
         if (current.isFosterParenting()) {
@@ -5851,8 +5805,6 @@ private void appendToCurrentNodeAndPushElementMayFoster(ElementName elementName,
         checkAttributes(attributes, "http://www.w3.org/1999/xhtml");
         // ]NOCPP]
         // Can't be called for custom elements
-        // Clone to selectedcontent if inside active option
-        cloneElementToSelectedContent("http://www.w3.org/1999/xhtml", elementName.getName(), attributes);
         T elt;
         T formOwner = form == null || fragment || isTemplateContents() ? null : form;
         StackNode<T> current = stack[currentPtr];
@@ -6041,55 +5993,6 @@ private void appendVoidFormToCurrent(HtmlAttributes attributes) throws SAXExcept
         elementPopped("http://www.w3.org/1999/xhtml", "form", elt);
     }
 
-    /**
-     * Clones an element to the selectedcontent hierarchy when inside an active option.
-     * This is used for the customizable select feature.
-     *
-     * @param ns The namespace URI
-     * @param name The element name
-     * @param attributes The attributes (will be cloned)
-     */
-    private void cloneElementToSelectedContent(@NsUri String ns, @Local String name,
-            HtmlAttributes attributes) throws SAXException {
-        if (activeOptionStackPos < 0 || selectedContentCloneStack.isEmpty()) {
-            return;
-        }
-        // Clone the attributes
-        HtmlAttributes clonedAttrs = attributes.cloneAttributes();
-        // Get the current parent in the selectedcontent hierarchy
-        T selectedContentParent = selectedContentCloneStack.get(selectedContentCloneStack.size() - 1);
-        // Create a clone element
-        T clone = createElement(ns, name, clonedAttrs, selectedContentParent
-                // CPPONLY: , htmlCreator(null)
-                );
-        // Append the clone to the selectedcontent parent
-        appendElement(clone, selectedContentParent);
-        // Push the clone to the stack so nested content goes into it
-        selectedContentCloneStack.add(clone);
-    }
-
-    /**
-     * Clones a void element to the selectedcontent hierarchy when inside an active option.
-     * Void elements don't need to be pushed to the stack since they have no children.
-     */
-    private void cloneVoidElementToSelectedContent(@NsUri String ns, @Local String name,
-            HtmlAttributes attributes) throws SAXException {
-        if (activeOptionStackPos < 0 || selectedContentCloneStack.isEmpty()) {
-            return;
-        }
-        // Clone the attributes
-        HtmlAttributes clonedAttrs = attributes.cloneAttributes();
-        // Get the current parent in the selectedcontent hierarchy
-        T selectedContentParent = selectedContentCloneStack.get(selectedContentCloneStack.size() - 1);
-        // Create a clone element
-        T clone = createElement(ns, name, clonedAttrs, selectedContentParent
-                // CPPONLY: , htmlCreator(null)
-                );
-        // Append the clone to the selectedcontent parent
-        appendElement(clone, selectedContentParent);
-        // Void elements don't need to be pushed to the stack
-    }
-
     // [NOCPP[
 
     private final void accumulateCharactersForced(@Const @NoLength char[] buf,
@@ -6125,10 +6028,6 @@ private final void accumulateCharactersForced(@Const @NoLength char[] buf,
     protected void accumulateCharacters(@Const @NoLength char[] buf, int start,
             int length) throws SAXException {
         appendCharacters(stack[currentPtr].node, buf, start, length);
-        // Also clone to selectedcontent if in active option
-        if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
-            appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), buf, start, length);
-        }
     }
 
     // ------------------------------- //
@@ -6157,12 +6056,14 @@ protected abstract T createHtmlElementSetAsRoot(HtmlAttributes attributes)
     protected abstract void detachFromParent(T element) throws SAXException;
 
     /**
-     * Deep clones the children of the source element to the destination element.
-     * Used for cloning option content to selectedcontent.
-     * Default implementation does nothing. Subclasses should override.
+     * Called when the active option is popped from the stack, to clone
+     * the option's children into selectedcontent. Subclasses that support
+     * DOM operations should override this to clear selectedcontent and
+     * deep-clone the option's children into it.
      */
-    protected void deepCloneChildren(T source, T destination) throws SAXException {
-        // Default implementation does nothing
+    protected void cloneOptionContentToSelectedContent(T option, T selectedContent)
+            throws SAXException {
+        // Default: no-op (streaming SAX mode ignores cloning)
     }
 
     protected abstract boolean hasChildren(T element) throws SAXException;
@@ -6208,16 +6109,6 @@ protected abstract void appendCommentToDocument(@NoLength char[] buf,
     protected abstract void addAttributesToElement(T element,
             HtmlAttributes attributes) throws SAXException;
 
-    /**
-     * Clears all children from the selectedcontent element.
-     * Used when an option with 'selected' attribute is seen after
-     * content has already been cloned from a previous option.
-     */
-    protected void clearSelectedContentChildren() throws SAXException {
-        // Default implementation does nothing. Subclasses that support
-        // selectedcontent cloning can override this.
-    }
-
     protected void markMalformedIfScript(T elt) throws SAXException {
 
     }
@@ -6423,10 +6314,6 @@ && charBufferContainsNonWhitespace()) {
                     // reconstructing gave us a new current node
                     appendCharacters(currentNode(), charBuffer, 0,
                             charBufferLen);
-                    // Also clone to selectedcontent if in active option
-                    if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
-                        appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
-                    }
                     charBufferLen = 0;
                     return;
                 }
@@ -6436,10 +6323,6 @@ && charBufferContainsNonWhitespace()) {
 
                 if (templatePos >= tablePos) {
                     appendCharacters(stack[templatePos].node, charBuffer, 0, charBufferLen);
-                    // Also clone to selectedcontent if in active option
-                    if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
-                        appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
-                    }
                     charBufferLen = 0;
                     return;
                 }
@@ -6447,18 +6330,10 @@ && charBufferContainsNonWhitespace()) {
                 StackNode<T> tableElt = stack[tablePos];
                 insertFosterParentedCharacters(charBuffer, 0, charBufferLen,
                         tableElt.node, stack[tablePos - 1].node);
-                // Also clone to selectedcontent if in active option
-                if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
-                    appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
-                }
                 charBufferLen = 0;
                 return;
             }
             appendCharacters(currentNode(), charBuffer, 0, charBufferLen);
-            // Also clone to selectedcontent if in active option
-            if (activeOptionStackPos >= 0 && !selectedContentCloneStack.isEmpty()) {
-                appendCharacters(selectedContentCloneStack.get(selectedContentCloneStack.size() - 1), charBuffer, 0, charBufferLen);
-            }
             charBufferLen = 0;
         }
     }
diff --git a/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java b/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
index 248a5015..6e4b708d 100644
--- a/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
+++ b/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
@@ -200,14 +200,13 @@ private Node previousSibling(Node table) {
     }
 
     @Override
-    protected void clearSelectedContentChildren() throws SAXException {
-        if (selectedContentPointer != null) {
-            ((ParentNode) selectedContentPointer).clearChildren();
-        }
+    protected void cloneOptionContentToSelectedContent(Element option, Element selectedContent)
+            throws SAXException {
+        ((ParentNode) selectedContent).clearChildren();
+        deepCloneChildren(option, selectedContent);
     }
 
-    @Override
-    protected void deepCloneChildren(Element source, Element destination) throws SAXException {
+    private void deepCloneChildren(Element source, Element destination) throws SAXException {
         Node child = source.getFirstChild();
         while (child != null) {
             deepCloneNode(child, destination);

From 4c01288c594a90e04210709384576048e20868c9 Mon Sep 17 00:00:00 2001
From: sideshowbarker <mike@w3.org>
Date: Mon, 2 Feb 2026 02:31:43 +0900
Subject: [PATCH 3/5] Remove TreeBuilder.SELECTEDCONTENT from
 treeBuilderGroupToName()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…no longer needed
---
 src/nu/validator/htmlparser/impl/ElementName.java | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/nu/validator/htmlparser/impl/ElementName.java b/src/nu/validator/htmlparser/impl/ElementName.java
index 46faf362..9b9f3ba8 100644
--- a/src/nu/validator/htmlparser/impl/ElementName.java
+++ b/src/nu/validator/htmlparser/impl/ElementName.java
@@ -557,8 +557,6 @@ public void destructor() {
 //                return "ANNOTATION_XML";
 //            case TreeBuilder.FOREIGNOBJECT_OR_DESC:
 //                return "FOREIGNOBJECT_OR_DESC";
-//            case TreeBuilder.SELECTEDCONTENT:
-//                return "SELECTEDCONTENT";
 //        }
 //        return null;
 //    }

From 08bbac62bdd49188f2875cd444c0a4b0811ac0d5 Mon Sep 17 00:00:00 2001
From: sideshowbarker <mike@w3.org>
Date: Mon, 2 Feb 2026 03:42:28 +0900
Subject: [PATCH 4/5] Implement option-pop cloning hook in all tree builders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add necessary corresponding implementations to the other tree builders
that construct persistent trees:

  - DOMTreeBuilder: uses the DOM cloneNode method for deep cloning
  - XOMTreeBuilder: uses XOM’s Node.copy() for deep cloning
  - BrowserTreeBuilder: uses the existing cloneNodeDeep method
---
 .../htmlparser/gwt/BrowserTreeBuilder.java      | 17 +++++++++++++++++
 .../htmlparser/dom/DOMTreeBuilder.java          | 17 +++++++++++++++++
 .../htmlparser/xom/XOMTreeBuilder.java          | 13 +++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/gwt-src/nu/validator/htmlparser/gwt/BrowserTreeBuilder.java b/gwt-src/nu/validator/htmlparser/gwt/BrowserTreeBuilder.java
index 2eaa6764..377150a3 100644
--- a/gwt-src/nu/validator/htmlparser/gwt/BrowserTreeBuilder.java
+++ b/gwt-src/nu/validator/htmlparser/gwt/BrowserTreeBuilder.java
@@ -474,4 +474,21 @@ private static native void removeChild(JavaScriptObject parent,
             fatal(e);
         }
     }
+
+    @Override
+    protected void cloneOptionContentToSelectedContent(
+            JavaScriptObject option, JavaScriptObject selectedContent)
+            throws SAXException {
+        try {
+            while (hasChildNodes(selectedContent)) {
+                removeChild(selectedContent, getFirstChild(selectedContent));
+            }
+            JavaScriptObject clone = cloneNodeDeep(option);
+            while (hasChildNodes(clone)) {
+                appendChild(selectedContent, getFirstChild(clone));
+            }
+        } catch (JavaScriptException e) {
+            fatal(e);
+        }
+    }
 }
diff --git a/src/nu/validator/htmlparser/dom/DOMTreeBuilder.java b/src/nu/validator/htmlparser/dom/DOMTreeBuilder.java
index 7470a151..c0fb6e2b 100644
--- a/src/nu/validator/htmlparser/dom/DOMTreeBuilder.java
+++ b/src/nu/validator/htmlparser/dom/DOMTreeBuilder.java
@@ -354,4 +354,21 @@ protected Element createAndInsertFosterParentedElement(String ns, String name,
             fatal(e);
         }
     }
+
+    @Override
+    protected void cloneOptionContentToSelectedContent(Element option,
+            Element selectedContent) throws SAXException {
+        try {
+            while (selectedContent.hasChildNodes()) {
+                selectedContent.removeChild(selectedContent.getFirstChild());
+            }
+            Node child = option.getFirstChild();
+            while (child != null) {
+                selectedContent.appendChild(child.cloneNode(true));
+                child = child.getNextSibling();
+            }
+        } catch (DOMException e) {
+            fatal(e);
+        }
+    }
 }
diff --git a/src/nu/validator/htmlparser/xom/XOMTreeBuilder.java b/src/nu/validator/htmlparser/xom/XOMTreeBuilder.java
index 635fc9ff..e760beb5 100644
--- a/src/nu/validator/htmlparser/xom/XOMTreeBuilder.java
+++ b/src/nu/validator/htmlparser/xom/XOMTreeBuilder.java
@@ -348,4 +348,17 @@ private int indexOfTable(Element table, Element stackParent) {
         cachedTableIndex = -1;
         cachedTable = null;
     }
+
+    @Override
+    protected void cloneOptionContentToSelectedContent(Element option,
+            Element selectedContent) throws SAXException {
+        try {
+            selectedContent.removeChildren();
+            for (int i = 0; i < option.getChildCount(); i++) {
+                selectedContent.appendChild(option.getChild(i).copy());
+            }
+        } catch (XMLException e) {
+            fatal(e);
+        }
+    }
 }

From 87fe37a1dd3ab6b2b224fbb1883d3cef294bf8c5 Mon Sep 17 00:00:00 2001
From: sideshowbarker <mike@w3.org>
Date: Mon, 2 Feb 2026 04:47:39 +0900
Subject: [PATCH 5/5] Avoid intermediate String allocation when cloning
 Characters nodes

Add a getBuffer() accessor to CharBufferNode so that deepCloneNode()
can copy directly from char[] to char[] via the Characters constructor,
instead of going through toString() and toCharArray().
---
 src/nu/validator/htmlparser/sax/SAXTreeBuilder.java | 5 +++--
 src/nu/validator/saxtree/CharBufferNode.java        | 8 ++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java b/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
index 6e4b708d..ab027a0c 100644
--- a/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
+++ b/src/nu/validator/htmlparser/sax/SAXTreeBuilder.java
@@ -236,8 +236,9 @@ private void deepCloneNode(Node node, ParentNode destination) throws SAXExceptio
                 break;
             case CHARACTERS:
                 // Clone the characters
-                String text = node.toString();
-                Characters cloneChars = new Characters(null, text.toCharArray(), 0, text.length());
+                Characters srcChars = (Characters) node;
+                char[] buf = srcChars.getBuffer();
+                Characters cloneChars = new Characters(null, buf, 0, buf.length);
                 destination.appendChild(cloneChars);
                 break;
             default:
diff --git a/src/nu/validator/saxtree/CharBufferNode.java b/src/nu/validator/saxtree/CharBufferNode.java
index 55c7715f..71ebf2f4 100644
--- a/src/nu/validator/saxtree/CharBufferNode.java
+++ b/src/nu/validator/saxtree/CharBufferNode.java
@@ -50,6 +50,14 @@ public abstract class CharBufferNode extends Node {
         System.arraycopy(buf, start, buffer, 0, length);
     }
 
+    /**
+     * Returns the buffer.
+     * @return the buffer
+     */
+    public char[] getBuffer() {
+        return buffer;
+    }
+
     /**
      * Returns the wrapped buffer as a string.
      *