Element::parserSetAttributes shouldn't trigger shadow tree constructi…

…on in TextFieldInputType::attributeChanged

https://bugs.webkit.org/show_bug.cgi?id=267936

Reviewed by Aditya Keerthi and Yusuke Suzuki.

Don't construct shadow tree in TextFieldInputType::attributeChanged.

* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::updateType): Sanitize the value before calling createShadowSubtreeIfNeeded. Otherwise,
we can assert in NumberInputType::localizeValue for example.

* Source/WebCore/html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::setSelectionRange):

* Source/WebCore/html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::isEmptyValue const): Now checks visibleValue() when the shadow tree doesn't exist yet.
(WebCore::TextFieldInputType::createShadowSubtree): Update the inner text value after creating the shadow tree.
(WebCore::TextFieldInputType::attributeChanged): Fixed the code so that it no longer constructs the shadow tree.

* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::visiblePlaceholder): Update the style / layout so that the shadow tree will get created.

Canonical link: https://commits.webkit.org/273461@main

Source/WebCore/html/HTMLInputElement.cpp

@@ -547,6 +547,10 @@ void HTMLInputElement::updateType(const AtomString& typeAttributeValue)
     bool previouslySelectable = m_inputType->supportsSelectionAPI();
 
     m_inputType = WTFMove(newType);
+    if (!didStoreValue && willStoreValue)
+        m_valueIfDirty = sanitizeValue(attributeWithoutSynchronization(valueAttr));
+    else
+        updateValueIfNeeded();
     m_inputType->createShadowSubtreeIfNeeded();
 
     // https://html.spec.whatwg.org/multipage/dom.html#auto-directionality
@@ -560,11 +564,6 @@ void HTMLInputElement::updateType(const AtomString& typeAttributeValue)
 
     updateWillValidateAndValidity();
 
-    if (!didStoreValue && willStoreValue)
-        m_valueIfDirty = sanitizeValue(attributeWithoutSynchronization(valueAttr));
-    else
-        updateValueIfNeeded();
-
     setFormControlValueMatchesRenderer(false);
     m_inputType->updateInnerTextValue();
 

Source/WebCore/html/HTMLTextFormControlElement.cpp

@@ -310,12 +310,13 @@ bool HTMLTextFormControlElement::setSelectionRange(unsigned start, unsigned end,
     if (!isTextField())
         return false;
 
+    auto innerText = innerTextElementCreatingShadowSubtreeIfNeeded();
+
     // Clamps to the current value length.
     unsigned innerTextValueLength = innerTextValue().length();
     end = std::min(end, innerTextValueLength);
     start = std::min(start, end);
 
-    auto innerText = innerTextElementCreatingShadowSubtreeIfNeeded();
     bool hasFocus = document().focusedElement() == this;
 
     RefPtr frame = document().frame();

Source/WebCore/html/TextFieldInputType.cpp

@@ -108,9 +108,9 @@ bool TextFieldInputType::isEmptyValue() const
 {
     auto innerText = innerTextElement();
     if (!innerText) {
-        // Since we always create the shadow subtree if a value is set, we know
-        // that the value is empty.
-        return true;
+        if (element()->shadowRoot())
+            return true; // Shadow tree is empty
+        return visibleValue().isEmpty();
     }
 
     for (Text* text = TextNodeTraversal::firstWithin(*innerText); text; text = TextNodeTraversal::next(*text, innerText.get())) {
@@ -357,11 +357,13 @@ void TextFieldInputType::createShadowSubtree()
     if (!createsContainer) {
         element()->userAgentShadowRoot()->appendChild(ContainerNode::ChildChange::Source::Parser, *m_innerText);
         updatePlaceholderText();
+        updateInnerTextValue();
         return;
     }
 
     createContainer(PreserveSelectionRange::No);
     updatePlaceholderText();
+    updateInnerTextValue();
 
     if (shouldHaveSpinButton) {
         m_innerSpinButton = SpinButtonElement::create(document, *this);
@@ -435,7 +437,7 @@ void TextFieldInputType::removeShadowSubtree()
 void TextFieldInputType::attributeChanged(const QualifiedName& name)
 {
     if (name == valueAttr || name == placeholderAttr) {
-        if (element())
+        if (element() && element()->shadowRoot())
             updateInnerTextValue();
     }
     InputType::attributeChanged(name);

Source/WebCore/testing/Internals.cpp

@@ -1531,6 +1531,8 @@ std::optional<Internals::EventThrottlingBehavior> Internals::eventThrottlingBeha
 
 String Internals::visiblePlaceholder(Element& element)
 {
+    element.document().updateLayout(LayoutOptions::IgnorePendingStylesheets);
+
     if (is<HTMLTextFormControlElement>(element)) {
         const HTMLTextFormControlElement& textFormControlElement = downcast<HTMLTextFormControlElement>(element);
         if (!textFormControlElement.isPlaceholderVisible())