Bug 1716599 [wpt PR 29388] - Safe slot reassigment, a=testonly

Automatic update from web-platform-tests Safe slot reassigment 1. Use GetWithoutInvalidation() instead of Get() in DCHECKs. We should never call Get() inside of a DCHECK(), because this can lead to a different code path depending on whether DCHECKs are enabled. 2. Get() should not cause immediate side effects. At most, it should queue up an invalidation for later processing. Fixing #1 and #2 were required in order to get past a first set of errors introduced by the new test. 3. The actual fix -- avoid infinite loop by calling a special new SlotAssignmentWillChange(), rather than ChildrenChanged(), where a minimal GetWithoutInvalidation() is called that does not lead to IsShadowContentRelevantForAccessibility() => FirstChild() => RecalcAssignedNodes() => ChildrenChanged() ... (infinite loop). A simpler potential fix is in CL:2965317 but requires more research. It's also mentioned in a TODO comment. Bug: 1219311 Change-Id: Iafaa289f241a851404ce352715d2970172a2e5f8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2961158 Reviewed-by: Joey Arhar <[email protected]> Reviewed-by: Mason Freed <[email protected]> Reviewed-by: Dominic Mazzoni <[email protected]> Commit-Queue: Aaron Leventhal <[email protected]> Cr-Commit-Position: refs/heads/master@{#892778} -- wpt-commits: 7b9ca7da96108c39142ebf9b6d639d9725beebf4 wpt-pr: 29388
jamienicol · Jun 16, 2021 · f078560 · f078560
1 parent 382607a
commit f078560
Showing 1 changed file with 34 additions and 0 deletions.
diff --git a/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html b/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html
@@ -0,0 +1,34 @@
+<html class="test-wait">
+<body>
+<script>
+customElements.define("my-detail", class extends HTMLElement {
+  constructor() {
+    super();
+    this.attachShadow({ mode: "open", slotAssignment: "manual" });
+  }
+  connectedCallback() {
+    const slot1 = document.createElement("slot");
+    const child1 = document.createElement("span");
+    this.appendChild(child1);
+    child1.innerHTML = "x";
+    this.shadowRoot.appendChild(slot1);
+    slot1.style.display = "block";
+    slot1.assign(child1);
+  }
+});
+
+function fuzz() {
+  document.designMode = 'on';
+  document.execCommand("selectAll");
+  document.execCommand("InsertText");
+  document.documentElement.className = '';
+}
+window.onload = () => {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(fuzz);
+  });
+};
+</script>
+<my-detail></my-detail>
+</body>
+</html>