Bug 227652

Summary:

Shadow host stops rendering after removing a slot, updating style, then its assigned node

Product:

WebKit

Reporter:

David Iglesias <ditman>

Component:

Layout and Rendering

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, cdumez, ditman, esprehn+autocc, ews-watchlist, kangil.han, koivisto, rniwa, simon.fraser, svillar, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

Safari 14

Hardware:

All

OS:

macOS 11

URL:

https://jsfiddle.net/ditman/rmwqjLah/

Bug Depends on:

Bug Blocks:

148695

Attachments:

Description	Flags
Reduction	none
patch	none

David Iglesias

Reported 2021-07-02 17:43:21 PDT

Given this DOM: div#container :shadowRoot | div#bg | slot[name=something] ` div#slotted[slot=something] If the slot element is removed from the shadow root, and then (in a separate timeout) div#slotted is removed from the light DOM, the div#container will lose its layout and become invisible on the page. Minimal repro case: * https://jsfiddle.net/ditman/rmwqjLah/ The following things happen in the link above: 1. The output becomes yellow (background of #container) 2. The output becomes green, and has some text (the slot inside of a div#bg container has been appended into the Shadow DOM) 3. The output becomes green, without text (the slot has been deleted from the Shadow DOM) 4. The output becomes RED (the div#slotted is removed from the Light DOM, and #container loses layout, revealing the body of the page behind it!) I'd expect that step 4 stays the same as step 3. I've tested other browsers and that's what they do. I've seen this bug with Safari 14 and 15 (Tech preview) in MacOS 11.4 (Big Sur) and stock Safari on iOS 14.6.

Attachments
Reduction (771 bytes, text/html) 2021-07-07 20:54 PDT, Ryosuke Niwa	no flags	Details
patch (3.58 KB, patch) 2021-07-08 06:21 PDT, Antti Koivisto	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.