Don't style recalc shadow root descendants if not necessary.

Sibling invalidation sets may be (re-)scheduled on shadow roots on dom changes. If the removed node was the one that needed style invalidation, we may end up with a style-dirty shadow root with no style-dirty children. There is a DCHECK in RecalcDescendantStyles which triggers if we call it unnecessarily. We called it unconditionally in ShadowRoot. Discovered while minimizing the fuzzer case for the mentioned Bug. Bug: 798918 Change-Id: I4f59b1a77af6a89ed304abd88d7f8cca84775127 Reviewed-on: https://chromium-review.googlesource.com/850395Reviewed-by: Eric Willigers <ericwilligers@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#526995}

Don't style recalc shadow root descendants if not necessary.
Sibling invalidation sets may be (re-)scheduled on shadow roots on dom changes. If the removed node was the one that needed style invalidation, we may end up with a style-dirty shadow root with no style-dirty children. There is a DCHECK in RecalcDescendantStyles which triggers if we call it unnecessarily. We called it unconditionally in ShadowRoot. Discovered while minimizing the fuzzer case for the mentioned Bug. Bug: 798918 Change-Id: I4f59b1a77af6a89ed304abd88d7f8cca84775127 Reviewed-on: https://chromium-review.googlesource.com/850395Reviewed-by: Eric Willigers <ericwilligers@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#526995}
aa00f194 · Rune Lillesveen · Commit Bot · 5f145943 · aa00f194 · aa00f194
Commit aa00f194 authored Jan 04, 2018 by Rune Lillesveen Committed by Commit Bot Jan 04, 2018
2 changed files
--- a/third_party/WebKit/LayoutTests/fast/css/invalidation/shadow-root-sibling-invalidation-crash.html
+++ b/third_party/WebKit/LayoutTests/fast/css/invalidation/shadow-root-sibling-invalidation-crash.html
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<style>
+  .a + .b { color: pink }
+</style>
+<div id="host"></div>
+<script>
+  test(() => {
+    var root = host.createShadowRoot();
+    root.innerHTML = "<span></span><span></span>";
+    var span = root.firstChild;
+    document.documentElement.offsetTop;
+    span.setAttribute("class", "a");
+    span.remove();
+  }, `Scheduling a sibling invalidation set on shadow root before remove()
+ should not cause a DCHECK failure`);
+</script>
--- a/third_party/WebKit/Source/core/dom/ShadowRoot.cpp
+++ b/third_party/WebKit/Source/core/dom/ShadowRoot.cpp
@@ -168,7 +168,8 @@ void ShadowRoot::RecalcStyle(StyleRecalcChange change) {
  // There's no style to update so just calling recalcStyle means we're updated.
  ClearNeedsStyleRecalc();
-  RecalcDescendantStyles(change);
+  if (change >= kUpdatePseudoElements || ChildNeedsStyleRecalc())
+    RecalcDescendantStyles(change);
  ClearChildNeedsStyleRecalc();
 }