Workaround for nested remove for datalists.

Nested removes confuses the style traversal roots. Make this a general workaround for UA shadow removals. Bug: 888236, 888448 Change-Id: Ia0165e7478c96282900a8191eeac18ae34586a2c Reviewed-on: https://chromium-review.googlesource.com/1238728Reviewed-by: Anders Ruud <andruud@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#593510}

Workaround for nested remove for datalists.
Nested removes confuses the style traversal roots. Make this a general workaround for UA shadow removals. Bug: 888236, 888448 Change-Id: Ia0165e7478c96282900a8191eeac18ae34586a2c Reviewed-on: https://chromium-review.googlesource.com/1238728Reviewed-by: Anders Ruud <andruud@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#593510}
f7623733 · Rune Lillesveen · Commit Bot · f3f5013b · f7623733 · f7623733
Commit f7623733 authored Sep 24, 2018 by Rune Lillesveen Committed by Commit Bot Sep 24, 2018
2 changed files
--- a/third_party/WebKit/LayoutTests/fast/css/style-traversal-root-datalist-crash.html
+++ b/third_party/WebKit/LayoutTests/fast/css/style-traversal-root-datalist-crash.html
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<div id="root">
+  <div id="d"></div>
+  <datalist id="messages">
+    <option>
+      <input list="messages">
+      <style>
+        .parent > .child { color:pink }
+      </style>
+    </option>
+  </datalist>
+</div>
+<script>
+  test(() => {
+    document.body.offsetTop;
+    // Make sure we have a StyleInvalidationRoot.
+    d.classList.add("parent");
+    // Nested remove() in UA shadow for <input list=messages>
+    root.remove();
+  }, "Nested removal should not cause a DCHECK or crash.");
+</script>
--- a/third_party/blink/renderer/core/css/style_engine.cc
+++ b/third_party/blink/renderer/core/css/style_engine.cc
@@ -1512,14 +1512,15 @@ void StyleEngine::NodeWillBeRemoved(Node& node) {
 void StyleEngine::ChildrenRemoved(ContainerNode& parent) {
  if (!parent.isConnected())
    return;
-  if (parent.IsShadowRoot() && ToShadowRoot(parent).IsUserAgent() &&
-      ToShadowRoot(parent).host().IsMediaControlElement()) {
-    // TODO(crbug.com/882869):
-    // This is a workaround for MediaControlLoadingPanelElement which removes
-    // its shadow root children as part of RemovedFrom() which means we do a
-    // removal from within another removal where isConnected() is not completely
-    // up to date which would confuse the code. Instead we will clean traversal
-    // roots properly in the outer remove.
+  if ((parent.IsShadowRoot() && ToShadowRoot(parent).IsUserAgent()) ||
+      parent.IsInUserAgentShadowRoot()) {
+    // This is a workaround for nested removals. There are elements which
+    // removes parts of its UA shadow DOM as part being removed which means we
+    // do a removal from within another removal where isConnected() is not
+    // completely up to date which would confuse this code. Instead we will
+    // clean traversal roots properly in the outer remove.
+    // TODO(crbug.com/882869): MediaControlLoadingPanelElement
+    // TODO(crbug.com/888448): TextFieldInputType::ListAttributeTargetChanged
    return;
  }
  style_invalidation_root_.ChildrenRemoved(parent);