Changeset 206403 in webkit

Timestamp:

Sep 26, 2016 4:45:21 PM (8 years ago)

Author:

Antti Koivisto

Message:

Input elements don't work inside shadow tree
​https://bugs.webkit.org/show_bug.cgi?id=160427

Reviewed by Darin Adler.

Source/WebCore:

There is a bug in ComposedTreeIterator. If the iterator is initialized with an initial state where the root
is inside a shadow tree it won't iterate into slots.

If an input element is in a shadow tree it generates narrowly scoped style updates. When RenderTreeUpdater
applies such an update the update root will be inside the shadow tree and the bug will prevent the render tree
for slotted content from updating.

Added tests for both the iterator behavior and the specific symptom with input elements.

Tests: fast/shadow-dom/composed-tree-shadow-child-subtree.html

fast/shadow-dom/input-element-in-shadow.html

• dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::ComposedTreeIterator):

Check and cache if the root is inside shadow tree.

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):

• dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::traverseNext):

If it is, always use the shadow traversal code path.

LayoutTests:

• fast/shadow-dom/composed-tree-shadow-child-subtree-expected.txt: Added.
• fast/shadow-dom/composed-tree-shadow-child-subtree.html: Added.
• fast/shadow-dom/input-element-in-shadow-expected.html: Added.
• fast/shadow-dom/input-element-in-shadow.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/shadow-dom/composed-tree-shadow-child-subtree-expected.txt (added)
• LayoutTests/fast/shadow-dom/composed-tree-shadow-child-subtree.html (added)
• LayoutTests/fast/shadow-dom/input-element-in-shadow-expected.html (added)
• LayoutTests/fast/shadow-dom/input-element-in-shadow.html (added)
• LayoutTests/platform/ios-simulator/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ComposedTreeIterator.cpp (modified) (4 diffs)
• Source/WebCore/dom/ComposedTreeIterator.h (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-09-26  Antti Koivisto  <antti@apple.com>
+
+        Input elements don't work inside shadow tree
+        https://bugs.webkit.org/show_bug.cgi?id=160427
+
+        Reviewed by Darin Adler.
+
+        * fast/shadow-dom/composed-tree-shadow-child-subtree-expected.txt: Added.
+        * fast/shadow-dom/composed-tree-shadow-child-subtree.html: Added.
+        * fast/shadow-dom/input-element-in-shadow-expected.html: Added.
+        * fast/shadow-dom/input-element-in-shadow.html: Added.
+
 2016-09-26  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/LayoutTests/platform/ios-simulator/TestExpectations

@@ -333 +333 @@
 webkit.org/b/155233 fast/events/max-tabindex-focus.html [ Skip ]
 fast/shadow-dom/shadow-host-removal-crash.html [ Skip ]
+fast/shadow-dom/input-element-in-shadow.html [ Skip ]
 
 # The file-wrapper part of <attachment> is not yet working on iOS

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-09-26  Antti Koivisto  <antti@apple.com>
+
+        Input elements don't work inside shadow tree
+        https://bugs.webkit.org/show_bug.cgi?id=160427
+
+        Reviewed by Darin Adler.
+
+        There is a bug in ComposedTreeIterator. If the iterator is initialized with an initial state where the root
+        is inside a shadow tree it won't iterate into slots.
+
+        If an input element is in a shadow tree it generates narrowly scoped style updates. When RenderTreeUpdater
+        applies such an update the update root will be inside the shadow tree and the bug will prevent the render tree
+        for slotted content from updating.
+
+        Added tests for both the iterator behavior and the specific symptom with input elements.
+
+        Tests: fast/shadow-dom/composed-tree-shadow-child-subtree.html
+               fast/shadow-dom/input-element-in-shadow.html
+
+        * dom/ComposedTreeIterator.cpp:
+        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
+
+            Check and cache if the root is inside shadow tree.
+
+        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+        * dom/ComposedTreeIterator.h:
+        (WebCore::ComposedTreeIterator::traverseNext):
+
+            If it is, always use the shadow traversal code path.
+
 2016-09-26  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/dom/ComposedTreeIterator.cpp

@@ -54 +54 @@
 
 ComposedTreeIterator::ComposedTreeIterator(ContainerNode& root, FirstChildTag)
+    : m_rootIsInShadowTree(root.isInShadowTree())
 {
     ASSERT(!is<ShadowRoot>(root));
@@ -74 +75 @@
 
 ComposedTreeIterator::ComposedTreeIterator(ContainerNode& root, Node& current)
+    : m_rootIsInShadowTree(root.isInShadowTree())
 {
     ASSERT(!is<ShadowRoot>(root));
@@ -156 +158 @@
 void ComposedTreeIterator::traverseNextInShadowTree()
 {
-    ASSERT(m_contextStack.size() > 1);
+    ASSERT(m_contextStack.size() > 1 || m_rootIsInShadowTree);
 
     if (is<HTMLSlotElement>(current())) {
@@ -176 +178 @@
 void ComposedTreeIterator::traverseNextLeavingContext()
 {
-    ASSERT(m_contextStack.size() > 1);
-
     while (context().iterator == context().end && m_contextStack.size() > 1) {
         m_contextStack.removeLast();

trunk/Source/WebCore/dom/ComposedTreeIterator.h

@@ -81 +81 @@
     Node& current() { return *context().iterator; }
 
+    bool m_rootIsInShadowTree { false };
     bool m_didDropAssertions { false };
     Vector<Context, 8> m_contextStack;
@@ -97 +98 @@
     }
 
-    if (m_contextStack.size() > 1) {
+    if (m_contextStack.size() > 1 || m_rootIsInShadowTree) {
         traverseNextInShadowTree();
         return *this;
@@ -110 +111 @@
     context().iterator.traverseNextSkippingChildren();
 
-    if (context().iterator == context().end && m_contextStack.size() > 1)
+    if (context().iterator == context().end)
         traverseNextLeavingContext();