HTML API: Ensure bookmark exaustion does not error

src/wp-includes/html-api/class-wp-html-processor.php

@@ -1040,8 +1040,17 @@ public function step( $node_to_process = self::PROCESS_NEXT_NODE ): bool {
 		$token_name            = $this->get_token_name();
 
 		if ( self::REPROCESS_CURRENT_NODE !== $node_to_process ) {
+			try {
+				$bookmark_name = $this->bookmark_token();
+			} catch ( Exception $e ) {
+				if ( self::ERROR_EXCEEDED_MAX_BOOKMARKS === $this->last_error ) {
+					return false;
+				}
+				throw $e;
+			}
+
 			$this->state->current_token = new WP_HTML_Token(
-				$this->bookmark_token(),
+				$bookmark_name,
 				$token_name,
 				$this->has_self_closing_flag(),
 				$this->release_internal_bookmark_on_destruct
@@ -1151,6 +1160,14 @@ public function step( $node_to_process = self::PROCESS_NEXT_NODE ): bool {
 			 * otherwise might involve messier calling and return conventions.
 			 */
 			return false;
+		} catch ( Exception $e ) {
+			if ( self::ERROR_EXCEEDED_MAX_BOOKMARKS === $this->last_error ) {
+				return false;
+			}
+			/*
+			 * Rethrow any other exceptions for higher-level handling.
+			 */
+			throw $e;
 		}
 	}
 
@@ -6287,6 +6304,8 @@ private function insert_foreign_element( WP_HTML_Token $token, bool $only_add_to
 	 *
 	 * @since 6.7.0
 	 *
+	 * @throws Exception When unable to allocate a bookmark for the next token in the input HTML document.
+	 *
 	 * @param string      $token_name    Name of token to create and insert into the stack of open elements.
 	 * @param string|null $bookmark_name Optional. Name to give bookmark for created virtual node.
 	 *                                   Defaults to auto-creating a bookmark name.

tests/phpunit/tests/html-api/wpHtmlProcessor.php

@@ -1068,7 +1068,7 @@ public function test_ensure_next_token_method_extensibility( $html, $expected_to
 	/**
 	 * Ensure that lowercased tag_name query matches tags case-insensitively.
 	 *
-	 * @group 62427
+	 * @ticket 62427
 	 */
 	public function test_next_tag_lowercase_tag_name() {
 		// The upper case <DIV> is irrelevant but illustrates the case-insentivity.
@@ -1079,4 +1079,61 @@ public function test_next_tag_lowercase_tag_name() {
 		$processor = WP_HTML_Processor::create_fragment( '<svg><RECT>' );
 		$this->assertTrue( $processor->next_tag( array( 'tag_name' => 'rect' ) ) );
 	}
+
+	/**
+	 * Ensure that the processor does not throw errors in cases of extreme HTML nesting.
+	 *
+	 * @ticket 64394
+	 *
+	 * @expectedIncorrectUsage WP_HTML_Tag_Processor::set_bookmark
+	 */
+	public function test_deep_nesting_fails_process_without_error() {
+		$html      = str_repeat( '<i>', WP_HTML_Processor::MAX_BOOKMARKS * 2 );
+		$processor = WP_HTML_Processor::create_fragment( $html );
+
+		// The fragment parser starts with a few context tokens already bookmarked.
+		$reached_tokens = ( function () {
+			return count( $this->bookmarks );
+		} )->call( $processor );
+		while ( $processor->next_token() ) {
+			++$reached_tokens;
+		}
+		$this->assertSame( WP_HTML_Processor::MAX_BOOKMARKS, $reached_tokens );
+	}
+
+	/**
+	 * @ticket 64394
+	 *
+	 * @expectedIncorrectUsage WP_HTML_Tag_Processor::set_bookmark
+	 */
+	public function test_deep_nesting_fails_processing_virtual_tokens_without_error() {
+		$html      = str_repeat( '<table><td>', WP_HTML_Processor::MAX_BOOKMARKS );
+		$processor = WP_HTML_Processor::create_fragment( $html );
+
+		// The fragment parser starts with a few context tokens already bookmarked.
+		$reached_tokens = ( function () {
+			return count( $this->bookmarks );
+		} )->call( $processor );
+		while ( $processor->next_token() ) {
+			++$reached_tokens;
+		}
+
+		/*
+		 * This test has some variability depending on how the virtual tokens align.
+		 * It will produce 1 real, 2 virtual, 1 real.
+		 *
+		 * "<table><td><table><td>…" produces:
+		 * └─TABLE
+		 *   └─TBODY (virtual)
+		 *     └─TR (virtual)
+		 *       └─TD
+		 *         └─TABLE
+		 *           └─TBODY (virtual)
+		 *             └─TR (virtual)
+		 *               └─TD
+		 *                 └─…
+		 */
+		$this->assertGreaterThanOrEqual( WP_HTML_Processor::MAX_BOOKMARKS - 1, $reached_tokens );
+		$this->assertLessThanOrEqual( WP_HTML_Processor::MAX_BOOKMARKS + 1, $reached_tokens );
+	}
 }