Update declarative Shadow DOM opt-in mechanics

The issue thread [1] has had more discussion, after the initial draft of declarative Shadow DOM opt-in landed [2]. This CL implements those bits of feedback. In particular: - There is no public allowDeclarativeShadowDom state available on Document or DocumentFragment. - All APIs use call parameters to avoid state, with the exception of DOMParser. - innerHTML no longer supports Declarative Shadow DOM. - A new setInnerHTML() function allows opt-in access to DSD. - Several of the more obscure APIs do not have an opt-in for declarative Shadow DOM, such as XHR, createContextualFragment, and document.write. - The sandbox flag has been removed from iframes completely. The new plan is to use DocumentPolicy to enable declarative Shadow DOM for iframes. For now, iframes always support declarative Shadow DOM. - 'allowDeclarativeShadowDOM' has become 'allowShadowRoot'. [1] whatwg/dom#912 (comment) [2] https://chromium-review.googlesource.com/c/chromium/src/+/2513525 Bug: 1042130 Change-Id: I3a2becf2a113cc8647b29077d2efea1c990d4547 Cq-Do-Not-Cancel-Tryjobs: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2530222 Auto-Submit: Mason Freed <[email protected]> Reviewed-by: Kouhei Ueno <[email protected]> Reviewed-by: Kinuko Yasuda <[email protected]> Commit-Queue: Mason Freed <[email protected]> Cr-Commit-Position: refs/heads/master@{#826643} GitOrigin-RevId: d5bf4401a47f04cbfbcca5d7fb4be5f99fa41e19
mjfroman · Nov 12, 2020 · 8e7a96f · 8e7a96f
1 parent 1850224
commit 8e7a96f
Show file tree

Hide file tree

Showing 45 changed files with 277 additions and 280 deletions.
diff --git a/blink/common/feature_policy/feature_policy.cc b/blink/common/feature_policy/feature_policy.cc
@@ -314,7 +314,6 @@ mojom::FeaturePolicyFeature FeaturePolicy::FeatureForSandboxFlag(
         kPropagatesToAuxiliaryBrowsingContexts:
     case network::mojom::WebSandboxFlags::kTopNavigationByUserActivation:
     case network::mojom::WebSandboxFlags::kStorageAccessByUserActivation:
-    case network::mojom::WebSandboxFlags::kDeclarativeShadowDom:
       break;
   }
   return mojom::FeaturePolicyFeature::kNotFound;

diff --git a/blink/renderer/bindings/generated_in_core.gni b/blink/renderer/bindings/generated_in_core.gni
@@ -111,6 +111,8 @@ generated_dictionary_sources_in_core = [
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_matrix_2d_init.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_matrix_init.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_matrix_init.h",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_parser_init.cc",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_parser_init.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_point_init.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_point_init.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_dom_quad_init.cc",
@@ -299,6 +301,8 @@ generated_dictionary_sources_in_core = [
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_scroll_to_options.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_security_policy_violation_event_init.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_security_policy_violation_event_init.h",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_set_inner_html_options.cc",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_set_inner_html_options.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_shadow_root_init.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_shadow_root_init.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_stream_pipe_options.h",

diff --git a/blink/renderer/bindings/idl_in_core.gni b/blink/renderer/bindings/idl_in_core.gni
@@ -162,6 +162,7 @@ static_idl_files_in_core = get_path_info(
           "//third_party/blink/renderer/core/dom/pointer_lock_options.idl",
           "//third_party/blink/renderer/core/dom/processing_instruction.idl",
           "//third_party/blink/renderer/core/dom/range.idl",
+          "//third_party/blink/renderer/core/dom/set_inner_html_options.idl",
           "//third_party/blink/renderer/core/dom/shadow_root.idl",
           "//third_party/blink/renderer/core/dom/shadow_root_init.idl",
           "//third_party/blink/renderer/core/dom/static_range.idl",
@@ -664,6 +665,7 @@ static_idl_files_in_core = get_path_info(
           "//third_party/blink/renderer/core/workers/worklet_options.idl",
           "//third_party/blink/renderer/core/xml/document_xpath_evaluator.idl",
           "//third_party/blink/renderer/core/xml/dom_parser.idl",
+          "//third_party/blink/renderer/core/xml/dom_parser_init.idl",
           "//third_party/blink/renderer/core/xml/xml_serializer.idl",
           "//third_party/blink/renderer/core/xml/xpath_evaluator.idl",
           "//third_party/blink/renderer/core/xml/xpath_expression.idl",

diff --git a/blink/renderer/core/core_idl_files.gni b/blink/renderer/core/core_idl_files.gni
@@ -652,6 +652,7 @@ core_dictionary_idl_files =
                     "dom/idle_request_options.idl",
                     "dom/mutation_observer_init.idl",
                     "dom/pointer_lock_options.idl",
+                    "dom/set_inner_html_options.idl",
                     "dom/shadow_root_init.idl",
                     "dom/events/add_event_listener_options.idl",
                     "dom/events/custom_event_init.idl",
@@ -758,6 +759,7 @@ core_dictionary_idl_files =
                     "trustedtypes/trusted_type_policy_options.idl",
                     "workers/worker_options.idl",
                     "workers/worklet_options.idl",
+                    "xml/dom_parser_init.idl",
                   ],
                   "abspath")
 

diff --git a/blink/renderer/core/dom/document.cc b/blink/renderer/core/dom/document.cc
@@ -6962,20 +6962,16 @@ void Document::MarkFirstPaint() {
   MaybeExecuteDelayedAsyncScripts();
 }
 
-using AllowState = blink::Document::DeclarativeShadowDomAllowState;
-AllowState Document::GetDeclarativeShadowDomAllowState() const {
-  return declarative_shadow_dom_allow_state_;
+using AllowState = blink::Document::DeclarativeShadowRootAllowState;
+AllowState Document::GetDeclarativeShadowRootAllowState() const {
+  return declarative_shadow_root_allow_state_;
 }
 
-void Document::setAllowDeclarativeShadowDom(bool val) {
-  declarative_shadow_dom_allow_state_ =
+void Document::setAllowDeclarativeShadowRoot(bool val) {
+  declarative_shadow_root_allow_state_ =
       val ? AllowState::kAllow : AllowState::kDeny;
 }
 
-bool Document::allowDeclarativeShadowDom() const {
-  return declarative_shadow_dom_allow_state_ == AllowState::kAllow;
-}
-
 void Document::FinishedParsing() {
   DCHECK(!GetScriptableDocumentParser() || !parser_->IsParsing());
   DCHECK(!GetScriptableDocumentParser() || ready_state_ != kLoading);

diff --git a/blink/renderer/core/dom/document.h b/blink/renderer/core/dom/document.h
@@ -1662,14 +1662,13 @@ class CORE_EXPORT Document : public ContainerNode,
   void MarkFirstPaint();
   void MaybeExecuteDelayedAsyncScripts();
 
-  enum class DeclarativeShadowDomAllowState : uint8_t {
+  enum class DeclarativeShadowRootAllowState : uint8_t {
     kNotSet,
     kAllow,
     kDeny
   };
-  DeclarativeShadowDomAllowState GetDeclarativeShadowDomAllowState() const;
-  void setAllowDeclarativeShadowDom(bool val);
-  bool allowDeclarativeShadowDom() const;
+  DeclarativeShadowRootAllowState GetDeclarativeShadowRootAllowState() const;
+  void setAllowDeclarativeShadowRoot(bool val);
 
   void SetFindInPageActiveMatchNode(Node*);
   const Node* GetFindInPageActiveMatchNode() const;
@@ -2212,8 +2211,8 @@ class CORE_EXPORT Document : public ContainerNode,
   int async_script_count_ = 0;
   bool first_paint_recorded_ = false;
 
-  DeclarativeShadowDomAllowState declarative_shadow_dom_allow_state_ =
-      DeclarativeShadowDomAllowState::kNotSet;
+  DeclarativeShadowRootAllowState declarative_shadow_root_allow_state_ =
+      DeclarativeShadowRootAllowState::kNotSet;
 
   WeakMember<Node> find_in_page_active_match_node_;
 

diff --git a/blink/renderer/core/dom/document.idl b/blink/renderer/core/dom/document.idl
@@ -197,9 +197,6 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
     // https://w3c.github.io/webappsec-feature-policy/#the-policy-object
     readonly attribute FeaturePolicy featurePolicy;
 
-    // Declarative Shadow DOM API
-    [RuntimeEnabled=DeclarativeShadowDOM] attribute boolean allowDeclarativeShadowDom;
-
     // Deprecated prefixed page visibility API.
     // TODO(davidben): This is a property so attaching a deprecation warning results in false positives when outputting
     // document in the console. It's possible https://crbug.com/43394 will resolve this.

diff --git a/blink/renderer/core/dom/document_fragment.idl b/blink/renderer/core/dom/document_fragment.idl
@@ -23,8 +23,6 @@
     Exposed=Window
 ] interface DocumentFragment : Node {
   [CallWith=Document] constructor();
-
-  [RuntimeEnabled=DeclarativeShadowDOM] attribute boolean allowDeclarativeShadowDom;
 };
 
 DocumentFragment includes ParentNode;

diff --git a/blink/renderer/core/dom/dom_implementation.cc b/blink/renderer/core/dom/dom_implementation.cc
@@ -109,6 +109,7 @@ Document* DOMImplementation::createHTMLDocument(const String& title) {
           .WithExecutionContext(document_->GetExecutionContext())
           .WithRegistrationContext(document_->RegistrationContext());
   auto* d = MakeGarbageCollected<HTMLDocument>(init);
+  d->setAllowDeclarativeShadowRoot(false);
   d->open();
   d->write("<!doctype html><html><head></head><body></body></html>");
   if (!title.IsNull()) {

diff --git a/blink/renderer/core/dom/element.cc b/blink/renderer/core/dom/element.cc
@@ -44,6 +44,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/v8_pointer_lock_options.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_scroll_into_view_options.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_scroll_to_options.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_set_inner_html_options.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_shadow_root_init.h"
 #include "third_party/blink/renderer/core/accessibility/ax_context.h"
 #include "third_party/blink/renderer/core/accessibility/ax_object_cache.h"
@@ -4462,14 +4463,17 @@ String Element::outerHTML() const {
   return CreateMarkup(this);
 }
 
-void Element::setInnerHTML(const String& html,
-                           ExceptionState& exception_state) {
-  probe::BreakableLocation(GetExecutionContext(), "Element.setInnerHTML");
+void Element::SetInnerHTMLInternal(const String& html,
+                                   const SetInnerHTMLOptions* options,
+                                   ExceptionState& exception_state) {
   if (html.IsEmpty() && !HasNonInBodyInsertionMode()) {
     setTextContent(html);
   } else {
+    bool allow_shadow_root =
+        options->hasAllowShadowRoot() && options->allowShadowRoot();
     if (DocumentFragment* fragment = CreateFragmentForInnerOuterHTML(
-            html, this, kAllowScriptingContent, "innerHTML", exception_state)) {
+            html, this, kAllowScriptingContent, "innerHTML", allow_shadow_root,
+            exception_state)) {
       ContainerNode* container = this;
       if (auto* template_element = DynamicTo<HTMLTemplateElement>(*this)) {
         // Allow replacing innerHTML on declarative shadow templates, prior to
@@ -4483,6 +4487,21 @@ void Element::setInnerHTML(const String& html,
   }
 }
 
+void Element::setInnerHTML(const String& html,
+                           ExceptionState& exception_state) {
+  probe::BreakableLocation(GetExecutionContext(), "Element.setInnerHTML");
+  const SetInnerHTMLOptions options;
+  SetInnerHTMLInternal(html, &options, exception_state);
+}
+
+void Element::setInnerHTMLWithOptions(const String& html,
+                                      const SetInnerHTMLOptions* options,
+                                      ExceptionState& exception_state) {
+  DCHECK(RuntimeEnabledFeatures::DeclarativeShadowDOMEnabled(
+      GetExecutionContext()));
+  SetInnerHTMLInternal(html, options, exception_state);
+}
+
 String Element::getInnerHTML(const GetInnerHTMLOptions* options) const {
   DCHECK(RuntimeEnabledFeatures::DeclarativeShadowDOMEnabled(
       GetExecutionContext()));
@@ -4521,7 +4540,8 @@ void Element::setOuterHTML(const String& html,
   Node* next = nextSibling();
 
   DocumentFragment* fragment = CreateFragmentForInnerOuterHTML(
-      html, parent, kAllowScriptingContent, "outerHTML", exception_state);
+      html, parent, kAllowScriptingContent, "outerHTML",
+      /*allow_shadow_root=*/false, exception_state);
   if (exception_state.HadException())
     return;
 
@@ -4703,7 +4723,7 @@ void Element::insertAdjacentHTML(const String& where,
   // Step 3 of http://domparsing.spec.whatwg.org/#insertadjacenthtml()
   DocumentFragment* fragment = CreateFragmentForInnerOuterHTML(
       markup, context_element, kAllowScriptingContent, "insertAdjacentHTML",
-      exception_state);
+      /*allow_shadow_root=*/false, exception_state);
   if (!fragment)
     return;
   InsertAdjacent(where, fragment, exception_state);

diff --git a/blink/renderer/core/dom/element.h b/blink/renderer/core/dom/element.h
@@ -66,6 +66,7 @@ class ExceptionState;
 class FloatQuad;
 class FloatSize;
 class FocusOptions;
+class SetInnerHTMLOptions;
 class GetInnerHTMLOptions;
 class HTMLTemplateElement;
 class Image;
@@ -697,6 +698,9 @@ class CORE_EXPORT Element : public ContainerNode, public Animatable {
   String innerHTML() const;
   String outerHTML() const;
   void setInnerHTML(const String&, ExceptionState& = ASSERT_NO_EXCEPTION);
+  void setInnerHTMLWithOptions(const String&,
+                               const SetInnerHTMLOptions*,
+                               ExceptionState& = ASSERT_NO_EXCEPTION);
   String getInnerHTML(const GetInnerHTMLOptions* options) const;
   void setOuterHTML(const String&, ExceptionState& = ASSERT_NO_EXCEPTION);
 
@@ -1185,6 +1189,10 @@ class CORE_EXPORT Element : public ContainerNode, public Animatable {
                                                         const QualifiedName&,
                                                         const AtomicString&);
 
+  void SetInnerHTMLInternal(const String&,
+                            const SetInnerHTMLOptions*,
+                            ExceptionState&);
+
   ElementRareData* GetElementRareData() const;
   ElementRareData& EnsureElementRareData();
 

diff --git a/blink/renderer/core/dom/element.idl b/blink/renderer/core/dom/element.idl
@@ -96,8 +96,9 @@ callback ScrollStateCallback = void (ScrollState scrollState);
     [Affects=Nothing, CEReactions, CustomElementCallbacks, RaisesException=Setter] attribute [TreatNullAs=EmptyString, StringContext=TrustedHTML] DOMString outerHTML;
     [CEReactions, CustomElementCallbacks, RaisesException] void insertAdjacentHTML(DOMString position, HTMLString text);
 
-    // Declarative Shadow DOM getInnerHTML() function.
-    [RuntimeEnabled=DeclarativeShadowDOM, RuntimeCallStatsCounter=ElementGetInnerHTML] HTMLString getInnerHTML(optional GetInnerHTMLOptions options = {});
+    // Declarative Shadow DOM setInnerHTML/getInnerHTML() functions.
+    [Affects=Nothing, RuntimeEnabled=DeclarativeShadowDOM, RuntimeCallStatsCounter=ElementSetInnerHTML, RaisesException, ImplementedAs=setInnerHTMLWithOptions] void setInnerHTML(DOMString html, optional SetInnerHTMLOptions options = {});
+    [Affects=Nothing, RuntimeEnabled=DeclarativeShadowDOM, RuntimeCallStatsCounter=ElementGetInnerHTML] HTMLString getInnerHTML(optional GetInnerHTMLOptions options = {});
 
     // Pointer Lock
     // https://w3c.github.io/pointerlock/#extensions-to-the-element-interface

diff --git a/blink/renderer/core/dom/set_inner_html_options.idl b/blink/renderer/core/dom/set_inner_html_options.idl
@@ -0,0 +1,7 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+dictionary SetInnerHTMLOptions {
+  boolean allowShadowRoot = false;
+};
diff --git a/blink/renderer/core/dom/shadow_root.cc b/blink/renderer/core/dom/shadow_root.cc
@@ -27,6 +27,7 @@
 #include "third_party/blink/renderer/core/dom/shadow_root.h"
 
 #include "third_party/blink/public/platform/platform.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_set_inner_html_options.h"
 #include "third_party/blink/renderer/core/css/resolver/style_resolver.h"
 #include "third_party/blink/renderer/core/css/style_change_reason.h"
 #include "third_party/blink/renderer/core/css/style_engine.h"
@@ -116,12 +117,30 @@ String ShadowRoot::innerHTML() const {
   return CreateMarkup(this, kChildrenOnly);
 }
 
-void ShadowRoot::setInnerHTML(const String& markup,
-                              ExceptionState& exception_state) {
+void ShadowRoot::SetInnerHTMLInternal(const String& html,
+                                      const SetInnerHTMLOptions* options,
+                                      ExceptionState& exception_state) {
+  bool allow_shadow_root =
+      options->hasAllowShadowRoot() && options->allowShadowRoot();
   if (DocumentFragment* fragment = CreateFragmentForInnerOuterHTML(
-          markup, &host(), kAllowScriptingContent, "innerHTML",
-          exception_state))
+          html, &host(), kAllowScriptingContent, "innerHTML", allow_shadow_root,
+          exception_state)) {
     ReplaceChildrenWithFragment(this, fragment, exception_state);
+  }
+}
+
+void ShadowRoot::setInnerHTML(const String& html,
+                              ExceptionState& exception_state) {
+  const SetInnerHTMLOptions options;
+  SetInnerHTMLInternal(html, &options, exception_state);
+}
+
+void ShadowRoot::setInnerHTMLWithOptions(const String& html,
+                                         const SetInnerHTMLOptions* options,
+                                         ExceptionState& exception_state) {
+  DCHECK(RuntimeEnabledFeatures::DeclarativeShadowDOMEnabled(
+      GetExecutionContext()));
+  SetInnerHTMLInternal(html, options, exception_state);
 }
 
 void ShadowRoot::RebuildLayoutTree(WhitespaceAttacher& whitespace_attacher) {

diff --git a/blink/renderer/core/dom/shadow_root.h b/blink/renderer/core/dom/shadow_root.h
@@ -40,6 +40,7 @@ namespace blink {
 
 class Document;
 class ExceptionState;
+class SetInnerHTMLOptions;
 class ShadowRootV0;
 class SlotAssignment;
 class WhitespaceAttacher;
@@ -138,6 +139,9 @@ class CORE_EXPORT ShadowRoot final : public DocumentFragment, public TreeScope {
 
   String innerHTML() const;
   void setInnerHTML(const String&, ExceptionState& = ASSERT_NO_EXCEPTION);
+  void setInnerHTMLWithOptions(const String&,
+                               const SetInnerHTMLOptions*,
+                               ExceptionState& = ASSERT_NO_EXCEPTION);
 
   Node* Clone(Document&, CloneChildrenFlag) const override;
 
@@ -188,6 +192,10 @@ class CORE_EXPORT ShadowRoot final : public DocumentFragment, public TreeScope {
 
   SlotAssignment& EnsureSlotAssignment();
 
+  void SetInnerHTMLInternal(const String&,
+                            const SetInnerHTMLOptions*,
+                            ExceptionState&);
+
   void AddChildShadowRoot() { ++child_shadow_root_count_; }
   void RemoveChildShadowRoot() {
     DCHECK_GT(child_shadow_root_count_, 0u);

diff --git a/blink/renderer/core/dom/shadow_root.idl b/blink/renderer/core/dom/shadow_root.idl
@@ -35,6 +35,10 @@ interface ShadowRoot : DocumentFragment {
     [CEReactions, CustomElementCallbacks, RaisesException=Setter] attribute [TreatNullAs=EmptyString, StringContext=TrustedHTML] DOMString innerHTML;
     readonly attribute boolean delegatesFocus;
     [RuntimeEnabled=ManualSlotting] readonly attribute SlotAssignmentMode slotAssignment;
+
+    // Declarative Shadow DOM setInnerHTML function.
+    // TODO(crbug.com/1147752): Add getInnerHTML() here also.
+    [Affects=Nothing, RuntimeEnabled=DeclarativeShadowDOM, RaisesException, ImplementedAs=setInnerHTMLWithOptions] void setInnerHTML(DOMString html, optional SetInnerHTMLOptions options = {});
 };
 
 ShadowRoot includes DocumentOrShadowRoot;
diff --git a/blink/renderer/core/dom/slot_assignment_test.cc b/blink/renderer/core/dom/slot_assignment_test.cc
@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/dom/flat_tree_traversal.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_set_inner_html_options.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/node.h"
@@ -64,13 +65,14 @@ class SlotAssignmentTest : public testing::Test {
 void SlotAssignmentTest::SetUp() {
   dummy_page_holder_ = std::make_unique<DummyPageHolder>(IntSize(800, 600));
   document_ = &dummy_page_holder_->GetDocument();
-  document_->setAllowDeclarativeShadowDom(true);
   DCHECK(document_);
 }
 
 void SlotAssignmentTest::SetBody(const char* html) {
   Element* body = GetDocument().body();
-  body->setInnerHTML(String::FromUTF8(html));
+  SetInnerHTMLOptions options;
+  options.setAllowShadowRoot(true);
+  body->setInnerHTMLWithOptions(String::FromUTF8(html), &options);
   RemoveWhiteSpaceOnlyTextNode(*body);
 }
 
@@ -133,9 +135,9 @@ TEST_F(SlotAssignmentTest, AssignedNodesAreSet) {
 TEST_F(SlotAssignmentTest, ScheduleVisualUpdate) {
   SetBody(R"HTML(
     <div id="host">
-      <shadowroot>
+      <template shadowroot=open>
         <slot></slot>
-      </shadowroot>
+      </template>
       <div></div>
     </div>
   )HTML");