Media element attributes resolve against the fragment parser's inert document's base URL #13068

The HTML fragment parsing algorithm creates elements in an inert Document (base URL about:blank) and only adopts them into the target's node document on insertion. Three attributes resolve their URL eagerly, against the node document at the time the attribute is set, and never re-resolve on adoption:

media src — resource selection, "relative to the media element's node document when the src attribute was last changed" (#798)
video poster — poster frame determination runs when the element is created
track src — the track URL is computed when the attribute is set

So per spec, div.setHTMLUnsafe('<video src=movie.mp4>') resolves movie.mp4 against about:blank for top-level elements today, and for every element once #12756 parses sanitizing calls entirely in the inert document. No engine does this: Blink/WebKit/Gecko parse fragments into the target document and resolve media URLs lazily (Blink: SelectMediaResource → GetDocument().CompleteURL), and Blink re-resolves poster on document move like img (L33020).

(This is actually a manifestation of #798 and not a new issue, but the fragment parsing algorithms expose it in a different way)

Originally posted by @annevk as AI feedback in #12756 (comment)