Reject duplicate srcset descriptors after a zero-density descriptor #22738

Have you used AI?

Yes

Which part of webpack is affected?

html

Bug Description

parseSrcset uses truthiness checks to detect whether a descriptor is already present. The WHATWG parser accepts a density value of zero (0x), but the implementation stores it as numeric 0. As a result, a following descriptor is not recognized as conflicting and is accepted too.

Link to Minimal Reproduction and steps to reproduce

Repository: https://github.com/webpack/webpack

Steps:

1. Check out main (reproduced at commit e12e122).
2. Run:

   const { parseSrcset } = require("./lib/html/syntax-parser");
   console.log(parseSrcset("a.png 0x 1x"));

3. It returns [["a.png", 0, 5]]. Also try a.png 0x 1w and a.png 0x 1h.

Expected Behavior

Accept a single 0x descriptor, but reject a second x, w, or h descriptor in the same candidate with Invalid srcset descriptor. In the HTML parser, the invalid value should be reported as a bad srcset attribute.

Actual Behavior

The parser accepts 0x 1x (and 0x 1w / 0x 1h) and returns the URL candidate instead of reporting invalid descriptors.

Environment

webpack: 5.112.0 (source checkout at e12e1224)
System: Windows 11 10.0.26300 (x64)
Node: 24.14.0
npm: 11.9.0

Is this a regression?

None

Last Working Version

No response

Additional Context

The WHATWG “parse a srcset attribute” algorithm accepts zero density (it only rejects density values less than zero) and treats the descriptor as present: https://html.spec.whatwg.org/multipage/images.html#parse-a-srcset-attribute

Scope: descriptor-presence checks in lib/html/syntax-parser.js.

Acceptance criteria:

• Preserve acceptance of a.png 0x.
• Reject 0x 1x, 0x 1w, and 0x 1h in one candidate.
• Add a focused regression test.

AI assistance was used for code inspection and report drafting; the behavior was reproduced against webpack main.