[HiC] Fix issues with shadow dom canvas children [chromium/src : main]

0 views
Skip to first unread message

Stephen Chenney (Gerrit)

unread,
Jun 3, 2026, 10:27:08 PMJun 3
to Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
Attention needed from Philip Rogers and Rune Lillesveen

Stephen Chenney added 1 comment

Patchset-level comments
File-level comment, Patchset 1 (Latest):
Stephen Chenney . resolved

There is a huge amount of potential testing to be done here. I tried to cover the basics to be sure that paint flags are set inside the shadow tree and the style system also correctly identified canvas children inside a shadow dom. Note it fixes the more complex example with forms and the autofill example.

I still need to add unit tests for the autofill problem, but please provide any early review if you have the chance.

Open in Gerrit

Related details

Attention is currently required from:
  • Philip Rogers
  • Rune Lillesveen
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
Gerrit-Change-Number: 7899615
Gerrit-PatchSet: 1
Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
Gerrit-Attention: Philip Rogers <p...@chromium.org>
Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
Gerrit-Comment-Date: Thu, 04 Jun 2026 02:26:52 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Rune Lillesveen (Gerrit)

unread,
Jun 4, 2026, 4:20:59 AMJun 4
to Stephen Chenney, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
Attention needed from Philip Rogers and Stephen Chenney

Rune Lillesveen added 1 comment

Patchset-level comments
File-level comment, Patchset 2 (Latest):
Rune Lillesveen . resolved

I'll wait until the tests pass

Open in Gerrit

Related details

Attention is currently required from:
  • Philip Rogers
  • Stephen Chenney
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
Gerrit-Change-Number: 7899615
Gerrit-PatchSet: 2
Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
Gerrit-Attention: Philip Rogers <p...@chromium.org>
Gerrit-Comment-Date: Thu, 04 Jun 2026 08:20:37 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Stephen Chenney (Gerrit)

unread,
Jun 5, 2026, 8:27:04 AMJun 5
to Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
Attention needed from Philip Rogers and Rune Lillesveen

Stephen Chenney voted and added 2 comments

Votes added by Stephen Chenney

Commit-Queue+1

2 comments

Patchset-level comments
Rune Lillesveen . resolved

I'll wait until the tests pass

Stephen Chenney

Yep. Thanks.

File-level comment, Patchset 3 (Latest):
Stephen Chenney . resolved

I'm wondering how important it is to avoid resetting the style on elements outside the flat tree during a moveBefore operation. I understand that the point of moveBefore is to avoid recomputing style if possible, but maybe we can tolerate it for elements inside a shadow-dom. Anyways, this versions passes tests locally but I have not thoroughly tested the change I made to fix the moveBefore test.

Open in Gerrit

Related details

Attention is currently required from:
  • Philip Rogers
  • Rune Lillesveen
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
Gerrit-Change-Number: 7899615
Gerrit-PatchSet: 3
Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
Gerrit-Attention: Philip Rogers <p...@chromium.org>
Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
Gerrit-Comment-Date: Fri, 05 Jun 2026 12:26:25 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: Rune Lillesveen <fut...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

Rune Lillesveen (Gerrit)

unread,
Jun 8, 2026, 4:22:46 AMJun 8
to Stephen Chenney, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
Attention needed from Philip Rogers and Stephen Chenney

Rune Lillesveen added 5 comments

Patchset-level comments
File-level comment, Patchset 4 (Latest):
Rune Lillesveen . resolved

Slightly worried about performance, but some DOM owner should have a look as well.

Commit Message
Line 9, Patchset 4 (Latest):Recursively mark shadow dom contetn as a canvas child
Rune Lillesveen . unresolved

content

Line 10, Patchset 4 (Latest):when it it's slotting status changes (flat tree parent
Rune Lillesveen . unresolved

its

File third_party/blink/renderer/core/dom/element.cc
Line 4398, Patchset 4 (Latest):void Element::SetIsCanvasOrInCanvasSubtreeRecursively(bool value) {
Rune Lillesveen . unresolved

Remind me again why we cannot rely on an inherited ComputedStyle flag. Do we need to know this information for non-rendered elements, or before we do a style recalc?

Line 10405, Patchset 4 (Latest): if (IsPseudoElement()) {
Rune Lillesveen . unresolved

This block is probably doing the same thing as Node::FlatTreeParentForChildDirty(). Might want to consolidate into some Node::FlatTreeParentWithoutRecalc() if they are actually the same.

Open in Gerrit

Related details

Attention is currently required from:
  • Philip Rogers
  • Stephen Chenney
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
    Gerrit-Change-Number: 7899615
    Gerrit-PatchSet: 4
    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
    Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
    Gerrit-Attention: Philip Rogers <p...@chromium.org>
    Gerrit-Comment-Date: Mon, 08 Jun 2026 08:22:27 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Stephen Chenney (Gerrit)

    unread,
    Jun 8, 2026, 10:05:23 AMJun 8
    to Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
    Attention needed from Philip Rogers and Rune Lillesveen

    Stephen Chenney added 5 comments

    Patchset-level comments
    File-level comment, Patchset 6 (Latest):
    Stephen Chenney . resolved

    There are a couple of cases where we removed code that changes things when the tree status changes (video state and autofill suggestions). I'll need to add tests for those cases or otherwise make sure it's right. But I have a question about how to detect the situation. See other comments.

    Commit Message
    Line 9, Patchset 4:Recursively mark shadow dom contetn as a canvas child
    Rune Lillesveen . resolved

    content

    Stephen Chenney

    Done

    Line 10, Patchset 4:when it it's slotting status changes (flat tree parent
    Rune Lillesveen . resolved

    its

    Stephen Chenney

    Done

    File third_party/blink/renderer/core/dom/element.cc
    Line 4398, Patchset 4:void Element::SetIsCanvasOrInCanvasSubtreeRecursively(bool value) {
    Rune Lillesveen . unresolved

    Remind me again why we cannot rely on an inherited ComputedStyle flag. Do we need to know this information for non-rendered elements, or before we do a style recalc?

    Stephen Chenney

    We can and the latest CL does that. Sorry for wasting your time on this version, though the tests remain. One question arises from the need to respond to changes in canvas subtree status: Does StyleDidChange get called if a flag gets set on the style even though no property changes?

    Line 10405, Patchset 4: if (IsPseudoElement()) {
    Rune Lillesveen . resolved

    This block is probably doing the same thing as Node::FlatTreeParentForChildDirty(). Might want to consolidate into some Node::FlatTreeParentWithoutRecalc() if they are actually the same.

    Stephen Chenney

    Acknowledged

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Philip Rogers
    • Rune Lillesveen
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
    Gerrit-Change-Number: 7899615
    Gerrit-PatchSet: 6
    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
    Gerrit-Attention: Philip Rogers <p...@chromium.org>
    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Comment-Date: Mon, 08 Jun 2026 14:05:10 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Rune Lillesveen <fut...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Stephen Chenney (Gerrit)

    unread,
    Jun 8, 2026, 10:11:31 AMJun 8
    to Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
    Attention needed from Philip Rogers and Rune Lillesveen

    Stephen Chenney added 4 comments

    File third_party/blink/renderer/core/html/forms/html_input_element.cc
    Line 1335, Patchset 6 (Parent):void HTMLInputElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . unresolved

    I'm worried about still needing this code path, though the test still passes. I'll verify more carefully.

    File third_party/blink/renderer/core/html/forms/html_select_element.cc
    Line 865, Patchset 6 (Parent):void HTMLSelectElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . unresolved

    Ditto.

    File third_party/blink/renderer/core/html/forms/html_text_area_element.cc
    Line 694, Patchset 6 (Parent):void HTMLTextAreaElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . unresolved

    ditto

    File third_party/blink/renderer/core/html/media/html_video_element.cc
    Line 745, Patchset 6 (Parent):void HTMLVideoElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . unresolved

    I need to verify whether we have testing that covers this code path because it has disappeared.

    Gerrit-Comment-Date: Mon, 08 Jun 2026 14:11:16 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Rune Lillesveen (Gerrit)

    unread,
    Jun 8, 2026, 2:56:15 PMJun 8
    to Stephen Chenney, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
    Attention needed from Philip Rogers and Stephen Chenney

    Rune Lillesveen added 3 comments

    File third_party/blink/renderer/core/css/resolver/style_adjuster.cc
    Line 1126, Patchset 7 (Latest): builder.SetIsInCanvasSubtree(true);
    Rune Lillesveen . unresolved

    This does a FlatTreeTraversal::ParentElement() for all elements resolving style.

    Wondering if it would make sense to instead have two bits, one non-inherited for canvas elements which are true for layoutSubtree(), and one inherited which the element is in a canvas+layoutSubtree() subtree. Then, setting the bits only happen for the StyleAdjuster for the canvas+layoutSubtree() elements. Checking for stacking context could check the parent_style's flag for layoutSubtree() if its own flag for in-canvas-subtree is true.

    Not sure if layoutSubtree() inside layoutSubtree() is possible, but something like this:

    ```
    [subtree-root] [canvas-subtree]
    div 0 0
    canvas[layoutSubtree] 1 1
    div 0 1
    canvas 0 1
    div 0 1
    canvas[layoutSubtree] 1? 1
    ```
    File third_party/blink/renderer/core/dom/element.cc
    Line 4398, Patchset 4:void Element::SetIsCanvasOrInCanvasSubtreeRecursively(bool value) {
    Rune Lillesveen . unresolved

    Remind me again why we cannot rely on an inherited ComputedStyle flag. Do we need to know this information for non-rendered elements, or before we do a style recalc?

    Stephen Chenney

    We can and the latest CL does that. Sorry for wasting your time on this version, though the tests remain. One question arises from the need to respond to changes in canvas subtree status: Does StyleDidChange get called if a flag gets set on the style even though no property changes?

    Rune Lillesveen

    Should be, as long as custom_compare is not set to true.

    File third_party/blink/renderer/core/html/forms/html_input_element.cc
    Line 1335, Patchset 6 (Parent):void HTMLInputElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . unresolved

    I'm worried about still needing this code path, though the test still passes. I'll verify more carefully.

    Rune Lillesveen

    I would think so. Slotting an autofilled input into a canvas subtree needs to change the rendering, I'd assume. I'm unsure that works well with this code as-is. Doing DOM changes from style recalc can typically be problematic. It could be that the rendering should behave as if the suggested value was the empty string, rather than actually setting it. But I'd need to look deeper to understand what's necessary.

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Philip Rogers
    • Stephen Chenney
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
    Gerrit-Change-Number: 7899615
    Gerrit-PatchSet: 7
    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
    Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
    Gerrit-Attention: Philip Rogers <p...@chromium.org>
    Gerrit-Comment-Date: Mon, 08 Jun 2026 18:55:53 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Stephen Chenney <sche...@chromium.org>
    Comment-In-Reply-To: Rune Lillesveen <fut...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Stephen Chenney (Gerrit)

    unread,
    Jun 10, 2026, 1:47:20 PMJun 10
    to Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
    Attention needed from Philip Rogers and Rune Lillesveen

    Stephen Chenney added 4 comments

    Patchset-level comments
    File-level comment, Patchset 7 (Latest):
    Stephen Chenney . resolved

    Still working to make sure the autofill suggestions get cleared. And I'll get rid of the flat tree traversal for all elements.

    File third_party/blink/renderer/core/css/resolver/style_adjuster.cc
    Line 1126, Patchset 7 (Latest): builder.SetIsInCanvasSubtree(true);
    Rune Lillesveen . unresolved

    This does a FlatTreeTraversal::ParentElement() for all elements resolving style.

    Wondering if it would make sense to instead have two bits, one non-inherited for canvas elements which are true for layoutSubtree(), and one inherited which the element is in a canvas+layoutSubtree() subtree. Then, setting the bits only happen for the StyleAdjuster for the canvas+layoutSubtree() elements. Checking for stacking context could check the parent_style's flag for layoutSubtree() if its own flag for in-canvas-subtree is true.

    Not sure if layoutSubtree() inside layoutSubtree() is possible, but something like this:

    ```
    [subtree-root] [canvas-subtree]
    div 0 0
    canvas[layoutSubtree] 1 1
    div 0 1
    canvas 0 1
    div 0 1
    canvas[layoutSubtree] 1? 1
    ```
    Stephen Chenney

    I think we can just check here for `IsA<HTMLCanvasElement>(element)` and `SetIsInCanvasSubtree(true)` and rely on inheritance to mark the subtree. And then in Element::IsInCanvasSubtree we explicitly check for the element being a canvas and return false. It sort of inverts the current IsInCanvasOrCanvasSubtree/IsInCanvasSubtree code. I'll verify that works.

    File third_party/blink/renderer/core/dom/element.cc
    Line 4398, Patchset 4:void Element::SetIsCanvasOrInCanvasSubtreeRecursively(bool value) {
    Rune Lillesveen . resolved

    Remind me again why we cannot rely on an inherited ComputedStyle flag. Do we need to know this information for non-rendered elements, or before we do a style recalc?

    Stephen Chenney

    We can and the latest CL does that. Sorry for wasting your time on this version, though the tests remain. One question arises from the need to respond to changes in canvas subtree status: Does StyleDidChange get called if a flag gets set on the style even though no property changes?

    Rune Lillesveen

    Should be, as long as custom_compare is not set to true.

    Stephen Chenney

    Thanks. It turns out I can use the InsertedInto logic to fix the issue with video.

    File third_party/blink/renderer/core/html/media/html_video_element.cc
    Line 745, Patchset 6 (Parent):void HTMLVideoElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . resolved

    I need to verify whether we have testing that covers this code path because it has disappeared.

    Stephen Chenney

    This was a bug. I have managed to create a test and fixed the issue.

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Philip Rogers
    • Rune Lillesveen
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
    Gerrit-Change-Number: 7899615
    Gerrit-PatchSet: 7
    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
    Gerrit-Attention: Philip Rogers <p...@chromium.org>
    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Comment-Date: Wed, 10 Jun 2026 17:47:09 +0000
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Rune Lillesveen (Gerrit)

    unread,
    Jun 10, 2026, 4:43:58 PMJun 10
    to Stephen Chenney, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
    Attention needed from Philip Rogers and Stephen Chenney

    Rune Lillesveen added 1 comment

    File third_party/blink/renderer/core/css/resolver/style_adjuster.cc
    Line 1126, Patchset 7 (Latest): builder.SetIsInCanvasSubtree(true);
    Rune Lillesveen . unresolved

    This does a FlatTreeTraversal::ParentElement() for all elements resolving style.

    Wondering if it would make sense to instead have two bits, one non-inherited for canvas elements which are true for layoutSubtree(), and one inherited which the element is in a canvas+layoutSubtree() subtree. Then, setting the bits only happen for the StyleAdjuster for the canvas+layoutSubtree() elements. Checking for stacking context could check the parent_style's flag for layoutSubtree() if its own flag for in-canvas-subtree is true.

    Not sure if layoutSubtree() inside layoutSubtree() is possible, but something like this:

    ```
    [subtree-root] [canvas-subtree]
    div 0 0
    canvas[layoutSubtree] 1 1
    div 0 1
    canvas 0 1
    div 0 1
    canvas[layoutSubtree] 1? 1
    ```
    Stephen Chenney

    I think we can just check here for `IsA<HTMLCanvasElement>(element)` and `SetIsInCanvasSubtree(true)` and rely on inheritance to mark the subtree. And then in Element::IsInCanvasSubtree we explicitly check for the element being a canvas and return false. It sort of inverts the current IsInCanvasOrCanvasSubtree/IsInCanvasSubtree code. I'll verify that works.

    Rune Lillesveen

    Don't you need to treat a <canvas> element in the <canvas> subtree differently from the root <canvas>?

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Philip Rogers
    • Stephen Chenney
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
    Gerrit-Change-Number: 7899615
    Gerrit-PatchSet: 7
    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
    Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
    Gerrit-Attention: Philip Rogers <p...@chromium.org>
    Gerrit-Comment-Date: Wed, 10 Jun 2026 20:43:41 +0000
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Stephen Chenney (Gerrit)

    unread,
    Jun 12, 2026, 10:09:07 AMJun 12
    to Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
    Attention needed from Philip Rogers and Rune Lillesveen

    Stephen Chenney added 5 comments

    Patchset-level comments
    Stephen Chenney . resolved

    I meant to send this last night, but didn't. Anyways ...

    Trying to use the style system has been an exercise in frustration. It seems we still need the equivalent of "DidChangeCanvasSubtree" for autofill suppression (currently recreating it in InsertedInto) and it looks like the iframe examples still need the recursive marking thing of some kind. But even then due to the timing of calls seems to cause problems particularly for moveBefore. At this point I think it's better to revert back to using the flags on element, particularly since this is an element concept rather than CSS. Maybe file a bug to revisit it later if we really want to use style.

    File third_party/blink/renderer/core/css/resolver/style_adjuster.cc
    Line 1126, Patchset 7 (Latest): builder.SetIsInCanvasSubtree(true);
    Rune Lillesveen . resolved

    This does a FlatTreeTraversal::ParentElement() for all elements resolving style.

    Wondering if it would make sense to instead have two bits, one non-inherited for canvas elements which are true for layoutSubtree(), and one inherited which the element is in a canvas+layoutSubtree() subtree. Then, setting the bits only happen for the StyleAdjuster for the canvas+layoutSubtree() elements. Checking for stacking context could check the parent_style's flag for layoutSubtree() if its own flag for in-canvas-subtree is true.

    Not sure if layoutSubtree() inside layoutSubtree() is possible, but something like this:

    ```
    [subtree-root] [canvas-subtree]
    div 0 0
    canvas[layoutSubtree] 1 1
    div 0 1
    canvas 0 1
    div 0 1
    canvas[layoutSubtree] 1? 1
    ```
    Stephen Chenney

    I think we can just check here for `IsA<HTMLCanvasElement>(element)` and `SetIsInCanvasSubtree(true)` and rely on inheritance to mark the subtree. And then in Element::IsInCanvasSubtree we explicitly check for the element being a canvas and return false. It sort of inverts the current IsInCanvasOrCanvasSubtree/IsInCanvasSubtree code. I'll verify that works.

    Rune Lillesveen

    Don't you need to treat a <canvas> element in the <canvas> subtree differently from the root <canvas>?

    Stephen Chenney

    We do not support nested canvas at this time, so no need for distinct treatment, and we have tests.

    File third_party/blink/renderer/core/html/forms/html_input_element.cc
    Line 1335, Patchset 6 (Parent):void HTMLInputElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . resolved

    I'm worried about still needing this code path, though the test still passes. I'll verify more carefully.

    Rune Lillesveen

    I would think so. Slotting an autofilled input into a canvas subtree needs to change the rendering, I'd assume. I'm unsure that works well with this code as-is. Doing DOM changes from style recalc can typically be problematic. It could be that the rendering should behave as if the suggested value was the empty string, rather than actually setting it. But I'd need to look deeper to understand what's necessary.

    Stephen Chenney

    I looked at this and I am very uncomfortable about returning an empty value when queried rather than setting the suggested value to null/empty. The problem is that not all code uses the getter method to access the suggested value. It's certainly harder to do it when set, however, so we may have no choice.

    I also discovered the problem with using style changes to trigger setting the value. Lesson learned.

    File third_party/blink/renderer/core/html/forms/html_select_element.cc
    Line 865, Patchset 6 (Parent):void HTMLSelectElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . resolved

    Ditto.

    Stephen Chenney

    Done

    File third_party/blink/renderer/core/html/forms/html_text_area_element.cc
    Line 694, Patchset 6 (Parent):void HTMLTextAreaElement::DidChangeIsCanvasOrInCanvasSubtree() {
    Stephen Chenney . resolved

    ditto

    Stephen Chenney

    Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Philip Rogers
    • Rune Lillesveen
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
      Gerrit-Change-Number: 7899615
      Gerrit-PatchSet: 7
      Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
      Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
      Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
      Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
      Gerrit-CC: Menard, Alexis <alexis...@intel.com>
      Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
      Gerrit-Attention: Philip Rogers <p...@chromium.org>
      Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
      Gerrit-Comment-Date: Fri, 12 Jun 2026 14:08:52 +0000
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Rune Lillesveen (Gerrit)

      unread,
      Jun 12, 2026, 10:26:15 AMJun 12
      to Stephen Chenney, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
      Attention needed from Philip Rogers and Stephen Chenney

      Rune Lillesveen added 2 comments

      Patchset-level comments
      Rune Lillesveen . resolved

      The style flag approach lgtm from my side, but win-rel reports about a flaky test, and pdr@ should review.

      File third_party/blink/renderer/core/css/resolver/style_adjuster.cc
      Line 1125, Patchset 7 (Latest): if (IsA<HTMLCanvasElement>(FlatTreeTraversal::ParentElement(*element))) {
      Rune Lillesveen . unresolved

      state.ParentElement() should be cheaper

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Philip Rogers
      • Stephen Chenney
      Submit Requirements:
        • requirement satisfiedCode-Coverage
        • requirement satisfiedCode-Owners
        • requirement is not satisfiedCode-Review
        • requirement is not satisfiedNo-Unresolved-Comments
        • requirement is not satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: chromium/src
        Gerrit-Branch: main
        Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
        Gerrit-Change-Number: 7899615
        Gerrit-PatchSet: 7
        Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
        Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
        Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
        Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
        Gerrit-CC: Menard, Alexis <alexis...@intel.com>
        Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
        Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
        Gerrit-Attention: Philip Rogers <p...@chromium.org>
        Gerrit-Comment-Date: Fri, 12 Jun 2026 14:25:58 +0000
        Gerrit-HasComments: Yes
        Gerrit-Has-Labels: No
        satisfied_requirement
        unsatisfied_requirement
        open
        diffy

        Stephen Chenney (Gerrit)

        unread,
        Jul 2, 2026, 3:27:46 PMJul 2
        to Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
        Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

        Stephen Chenney added 2 comments

        Patchset-level comments
        File-level comment, Patchset 15 (Latest):
        Stephen Chenney . resolved

        Finally have something that works consistently.

        File third_party/blink/renderer/core/css/resolver/style_adjuster.cc
        Line 1125, Patchset 7: if (IsA<HTMLCanvasElement>(FlatTreeTraversal::ParentElement(*element))) {
        Rune Lillesveen . resolved

        state.ParentElement() should be cheaper

        Stephen Chenney

        Acknowledged

        Open in Gerrit

        Related details

        Attention is currently required from:
        • Philip Rogers
        • Rune Lillesveen
        • Stefan Zager
        Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement satisfiedCode-Owners
          • requirement is not satisfiedCode-Review
          • requirement is not satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
          Gerrit-Change-Number: 7899615
          Gerrit-PatchSet: 15
          Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
          Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
          Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
          Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
          Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
          Gerrit-CC: Menard, Alexis <alexis...@intel.com>
          Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
          Gerrit-Attention: Stefan Zager <sza...@chromium.org>
          Gerrit-Attention: Philip Rogers <p...@chromium.org>
          Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
          Gerrit-Comment-Date: Thu, 02 Jul 2026 19:27:34 +0000
          Gerrit-HasComments: Yes
          Gerrit-Has-Labels: No
          Comment-In-Reply-To: Rune Lillesveen <fut...@chromium.org>
          satisfied_requirement
          unsatisfied_requirement
          open
          diffy

          Philip Rogers (Gerrit)

          unread,
          Jul 7, 2026, 7:11:09 PM (12 days ago) Jul 7
          to Stephen Chenney, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
          Attention needed from Rune Lillesveen, Stefan Zager and Stephen Chenney

          Philip Rogers added 7 comments

          File third_party/blink/renderer/core/dom/element.cc
          Line 4420, Patchset 15 (Latest):void Element::SetIsCanvasOrInCanvasSubtreeRecursively(bool value) {
          Philip Rogers . unresolved

          Merge this into `Element::SetIsCanvasOrInCanvasSubtree`? It's super confusing that we have both `Element::SetIsCanvasOrInCanvasSubtreeRecursively` and `Element ::SetIsCanvasOrInCanvasSubtree`.

          File third_party/blink/renderer/core/exported/web_form_control_element_test.cc
          Line 684, Patchset 15 (Latest):
          Philip Rogers . unresolved
          Can you add the following test? I think it will fail.
          ```
          TEST_F(WebFormControlElementTest,
          TextControlPreviewDisabledWhenUnslottedParentSlottedIntoCanvas) {
          ScopedCanvasDrawElementForTest forced_canvas_draw_element_feature(true);
            GetDocument().body()->SetHTMLUnsafeWithoutTrustedTypes(R"(
          <canvas layoutsubtree>
          <div id="host">
          <template shadowrootmode="open">
          <div id="slotwrapper">
          <slot name="s1"></slot>
          </div>
          </template>
          <div id="unslotted_parent">
          <input id="input_id">
          </div>
          </div>
          </canvas>
          )");
            Element* input_elmt = GetElementById("input_id");
          ASSERT_TRUE(input_elmt);
            WebFormControlElement input(DynamicTo<HTMLFormControlElement>(input_elmt));
            // The input is currently unslotted, so it is not in the flat tree or canvas.
          EXPECT_FALSE(input_elmt->IsInCanvasSubtree());
            // Suggestions should work while unslotted outside flat tree canvas.
          input.SetSuggestedValue("suggestion");
          EXPECT_EQ(input.SuggestedValue().Ascii(), "suggestion");
            // Now dynamically slot unslotted_parent into the canvas slot.
          GetElementById("unslotted_parent")
          ->setAttribute(html_names::kSlotAttr, AtomicString("s1"));
            // Force slot assignment recalc and style update.
          GetDocument().UpdateStyleAndLayoutTree();
            EXPECT_TRUE(input_elmt->IsInCanvasSubtree());
            // The input element's suggested value should be cleared when it enters
          // the canvas flat tree.
          EXPECT_TRUE(input.SuggestedValue().IsEmpty());
          }
          ```
          File third_party/blink/renderer/core/html/media/html_video_element_test.cc
          Line 735, Patchset 15 (Latest): EXPECT_CALL((*MockMediaPlayer()), RequestVideoFrameCallback()).Times(1);
          Philip Rogers . unresolved

          Can you also test that removing the video does not request video frame callbacks?
          ```
          // Appending to canvas should request video frames.
          EXPECT_CALL(*MockMediaPlayer(), RequestVideoFrameCallback()).Times(1);
          GetElementById("canvas")->appendChild(video);
          UpdateAllLifecyclePhasesForTest();
          testing::Mock::VerifyAndClearExpectations(MockMediaPlayer());

          // Removing from canvas should not trigger another frame callback request.
          EXPECT_CALL(*MockMediaPlayer(), RequestVideoFrameCallback()).Times(0);
          video->remove();
          UpdateAllLifecyclePhasesForTest();
          testing::Mock::VerifyAndClearExpectations(MockMediaPlayer());
          ```

          File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/canvas-in-custom-element-multiple-ref.html
          Line 4, Patchset 15 (Latest):<link rel="author" href="mailto:vmp...@chromium.org">
          Philip Rogers . unresolved

          remove or update to schenney@

          File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/canvas-in-custom-element-images-ignored.tentative.html
          Line 2, Patchset 15 (Latest):<html class="reftest-wait">
          Philip Rogers . unresolved

          remove reftest-wait

          Line 11, Patchset 15 (Latest): document.addEventListener('paint-received', (event) => {
          Philip Rogers . unresolved

          This test can run before this event is received. Can you wrap this in `promise_test(async () => {...}`?

          File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/support/CanvasWidgetWithImages.https.sub.js
          Line 23, Patchset 15 (Latest): <body>
          Philip Rogers . unresolved

          remove body and un-indent the <canvas>...</canvas>

          Open in Gerrit

          Related details

          Attention is currently required from:
          • Rune Lillesveen
          • Stefan Zager
          • Stephen Chenney
          Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement satisfiedCode-Owners
            • requirement is not satisfiedCode-Review
            • requirement is not satisfiedNo-Unresolved-Comments
            • requirement is not satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
            Gerrit-Change-Number: 7899615
            Gerrit-PatchSet: 15
            Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
            Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
            Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
            Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
            Gerrit-CC: Menard, Alexis <alexis...@intel.com>
            Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
            Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
            Gerrit-Attention: Stefan Zager <sza...@chromium.org>
            Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Comment-Date: Tue, 07 Jul 2026 23:10:56 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            Stephen Chenney (Gerrit)

            unread,
            Jul 8, 2026, 9:56:05 PM (10 days ago) Jul 8
            to Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
            Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

            Stephen Chenney added 8 comments

            Patchset-level comments
            File-level comment, Patchset 17 (Latest):
            Stephen Chenney . resolved

            Note the slotting test you suggested adding fails because things slot anywhere if they do not include a specific "slot" attribute. So the test was not verifying a change in slotting status.

            File third_party/blink/renderer/core/dom/element.cc
            Line 4420, Patchset 15:void Element::SetIsCanvasOrInCanvasSubtreeRecursively(bool value) {
            Philip Rogers . resolved

            Merge this into `Element::SetIsCanvasOrInCanvasSubtree`? It's super confusing that we have both `Element::SetIsCanvasOrInCanvasSubtreeRecursively` and `Element ::SetIsCanvasOrInCanvasSubtree`.

            Stephen Chenney

            Done

            File third_party/blink/renderer/core/exported/web_form_control_element_test.cc
            Line 684, Patchset 15:
            Philip Rogers . resolved
            Stephen Chenney
            This is covered by TEST_F(WebFormControlElementTest,
            TextControlPreviewDisabledInCanvasWhenNestedAndSlotted)
            File third_party/blink/renderer/core/html/media/html_video_element_test.cc
            Line 735, Patchset 15: EXPECT_CALL((*MockMediaPlayer()), RequestVideoFrameCallback()).Times(1);
            Philip Rogers . resolved

            Can you also test that removing the video does not request video frame callbacks?
            ```
            // Appending to canvas should request video frames.
            EXPECT_CALL(*MockMediaPlayer(), RequestVideoFrameCallback()).Times(1);
            GetElementById("canvas")->appendChild(video);
            UpdateAllLifecyclePhasesForTest();
            testing::Mock::VerifyAndClearExpectations(MockMediaPlayer());

            // Removing from canvas should not trigger another frame callback request.
            EXPECT_CALL(*MockMediaPlayer(), RequestVideoFrameCallback()).Times(0);
            video->remove();
            UpdateAllLifecyclePhasesForTest();
            testing::Mock::VerifyAndClearExpectations(MockMediaPlayer());
            ```

            Stephen Chenney

            Done

            File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/canvas-in-custom-element-multiple-ref.html
            Line 4, Patchset 15:<link rel="author" href="mailto:vmp...@chromium.org">
            Philip Rogers . resolved

            remove or update to schenney@

            Stephen Chenney

            Done

            File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/canvas-in-custom-element-images-ignored.tentative.html
            Line 2, Patchset 15:<html class="reftest-wait">
            Philip Rogers . resolved

            remove reftest-wait

            Stephen Chenney

            Done

            Line 11, Patchset 15: document.addEventListener('paint-received', (event) => {
            Philip Rogers . unresolved

            This test can run before this event is received. Can you wrap this in `promise_test(async () => {...}`?

            Stephen Chenney

            This is listening for the custom event from the custom element. It actually needs to be in this location so that the event listener is set up before the custom element is created because otherwise the custom element can send the event before the listener is there to get it, causing timeouts.

            So the sequence looks like this:

            • Set up the event listener for "paint-received" on the main document
            • Creating the canvas-widget causes it to request "paint" events
            • When the custom widget gets the "paint" event it paints, and then sends "paint-received"
            • The main document event handler runs and executes the test on the data from the custom widget

            I verified that the test does run:
            canvas-in-custom-element-images-ignored.tentative.html: Test OK. Subtests passed 1/1. Unexpected 0

            Were you concerned about something else?

            File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/support/CanvasWidgetWithImages.https.sub.js
            Line 23, Patchset 15: <body>
            Philip Rogers . resolved

            remove body and un-indent the <canvas>...</canvas>

            Stephen Chenney

            Done

            Open in Gerrit

            Related details

            Attention is currently required from:
            • Philip Rogers
            • Rune Lillesveen
            • Stefan Zager
            Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement satisfiedCode-Owners
            • requirement is not satisfiedCode-Review
            • requirement is not satisfiedNo-Unresolved-Comments
            • requirement is not satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
            Gerrit-Change-Number: 7899615
            Gerrit-PatchSet: 17
            Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
            Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
            Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
            Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
            Gerrit-CC: Menard, Alexis <alexis...@intel.com>
            Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
            Gerrit-Attention: Philip Rogers <p...@chromium.org>
            Gerrit-Attention: Stefan Zager <sza...@chromium.org>
            Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Comment-Date: Thu, 09 Jul 2026 01:55:50 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: No
            Comment-In-Reply-To: Philip Rogers <p...@chromium.org>
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            Stephen Chenney (Gerrit)

            unread,
            Jul 9, 2026, 8:15:09 AM (10 days ago) Jul 9
            to Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
            Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

            Stephen Chenney added 1 comment

            Patchset-level comments
            Stephen Chenney . resolved

            Please review Patchset 16 because the changes in Patchset 17 are only there to see if we need to check the subtree when the root node status changed. For some reason they are failing and I'm working out why. Meanwhile. Patchset 16 works.

            Gerrit-Comment-Date: Thu, 09 Jul 2026 12:14:53 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            Stephen Chenney (Gerrit)

            unread,
            Jul 9, 2026, 3:57:06 PM (10 days ago) Jul 9
            to Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
            Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

            Stephen Chenney added 1 comment

            Patchset-level comments
            File-level comment, Patchset 18 (Latest):
            Stephen Chenney . resolved

            The latest version is the one for now.

            In a follow up I plan to switch the element flag back to IsInCanvasSubtree because making that cheap and then checking IsA<HTMLCanvasElement> in addition for IsCanvasOrInCanvasSubtree is cheaper than the current version that does a lot of work to find a parent in IsInCanvasSubtree.

            Open in Gerrit

            Related details

            Attention is currently required from:
            • Philip Rogers
            • Rune Lillesveen
            • Stefan Zager
            Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement satisfiedCode-Owners
            • requirement is not satisfiedCode-Review
            • requirement is not satisfiedNo-Unresolved-Comments
            • requirement is not satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
            Gerrit-Change-Number: 7899615
            Gerrit-PatchSet: 18
            Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
            Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
            Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
            Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
            Gerrit-CC: Menard, Alexis <alexis...@intel.com>
            Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
            Gerrit-Attention: Philip Rogers <p...@chromium.org>
            Gerrit-Attention: Stefan Zager <sza...@chromium.org>
            Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Comment-Date: Thu, 09 Jul 2026 19:56:55 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            Philip Rogers (Gerrit)

            unread,
            Jul 9, 2026, 8:15:45 PM (9 days ago) Jul 9
            to Stephen Chenney, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
            Attention needed from Rune Lillesveen, Stefan Zager and Stephen Chenney

            Philip Rogers added 4 comments

            Commit Message
            Line 20, Patchset 18 (Latest):* The style based relied on suppressing autofill data at the getter stage, rather than on setting. I think a setter approach is more robust to future changes.
            Philip Rogers . unresolved

            nit: wrap

            File third_party/blink/renderer/core/dom/node.cc
            Line 3824, Patchset 18 (Latest): // Only set canvas subtree state for elements that are participating in
            Philip Rogers . unresolved

            Remove the comment and IsNodeInFlatTree check and just call `element->SetIsCanvasOrInCanvasSubtree(element->IsInCanvasSubtree());`?

            This test fails, and passes with this suggestion.
            ```
            TEST_F(
            WebFormControlElementTest,
            TextControlPreviewDisabledWhenSlottedIntoCanvasAfterStyleEnsuredOutsideFlatTree) {
            ScopedCanvasDrawElementForTest forced_canvas_draw_element_feature(true);
            ScopedGetComputedStyleOutsideFlatTreeForTest scoped_feature(true);
              GetDocument().body()->SetHTMLUnsafeWithoutTrustedTypes(R"(

            <div id="host">
            <template shadowrootmode="open">
                    <canvas id="canvas" layoutsubtree>
            <slot name="canvas_slot"></slot>
            </canvas>
            </template>
            <input id="input">
            </div>
            )");
              HTMLInputElement* input =
            DynamicTo<HTMLInputElement>(GetElementById("input"));
            ASSERT_TRUE(input);
              GetDocument().UpdateStyleAndLayoutTree();
              // Ensure computed style outside the flat tree before assigning to a slot.
            input->EnsureComputedStyle();
              WebFormControlElement form_control(input);
            form_control.SetSuggestedValue("suggestion");
              // Now slot 'input' into the canvas slot inside the shadow root.
            input->setAttribute(html_names::kSlotAttr, AtomicString("canvas_slot"));
            GetDocument().UpdateStyleAndLayoutTree();
              EXPECT_TRUE(input->IsInCanvasSubtree());
            EXPECT_TRUE(input->IsCanvasOrInCanvasSubtree());
            EXPECT_TRUE(form_control.SuggestedValue().IsEmpty());
            }
            ```
            Line 3838, Patchset 18 (Latest): element->DetachOverscroll();
            Philip Rogers . unresolved

            Call `element->SetIsCanvasOrInCanvasSubtree(element->IsInCanvasSubtree());` here?

            Here's a test that fails without this:
            ```
            TEST_F(WebFormControlElementTest,
            TextControlCanvasSubtreeStaleWhenUnslottedFromCanvas) {

            ScopedCanvasDrawElementForTest forced_canvas_draw_element_feature(true);

            GetDocument().body()->SetHTMLUnsafeWithoutTrustedTypes(R"(
                    <div id="host">                                                                                                                                                         
            <template shadowrootmode="open">
                        <canvas id="canvas" layoutsubtree>                                                                                                                                  
            <slot name="s1"></slot>
            </canvas>
            </template>
            <input id="input" slot="s1">
            </div>
            )");

            HTMLInputElement* input =
            DynamicTo<HTMLInputElement>(GetElementById("input"));
            GetDocument().UpdateStyleAndLayoutTree();

            EXPECT_TRUE(input->IsInCanvasSubtree());
            EXPECT_TRUE(input->IsCanvasOrInCanvasSubtree());

            // Unslot the input element so it is removed from the flat tree.
            input->setAttribute(html_names::kSlotAttr, AtomicString("nonexistent"));
            GetDocument().UpdateStyleAndLayoutTree();

            EXPECT_FALSE(input->IsInCanvasSubtree());
            // When removed from the flat tree (RemovedFromFlatTree), its canvas subtree
            // state should be updated so IsCanvasOrInCanvasSubtree() is false.
            EXPECT_FALSE(input->IsCanvasOrInCanvasSubtree());
            }
            ```
            File third_party/blink/web_tests/external/wpt/html/canvas/element/manual/draw-element-image/privacy/canvas-in-custom-element-images-ignored.tentative.html
            Line 11, Patchset 15: document.addEventListener('paint-received', (event) => {
            Philip Rogers . resolved

            This test can run before this event is received. Can you wrap this in `promise_test(async () => {...}`?

            Stephen Chenney

            This is listening for the custom event from the custom element. It actually needs to be in this location so that the event listener is set up before the custom element is created because otherwise the custom element can send the event before the listener is there to get it, causing timeouts.

            So the sequence looks like this:

            • Set up the event listener for "paint-received" on the main document
            • Creating the canvas-widget causes it to request "paint" events
            • When the custom widget gets the "paint" event it paints, and then sends "paint-received"
            • The main document event handler runs and executes the test on the data from the custom widget

            I verified that the test does run:
            canvas-in-custom-element-images-ignored.tentative.html: Test OK. Subtests passed 1/1. Unexpected 0

            Were you concerned about something else?

            Philip Rogers

            Acknowledged

            Open in Gerrit

            Related details

            Attention is currently required from:
            • Rune Lillesveen
            • Stefan Zager
            • Stephen Chenney
            Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement satisfiedCode-Owners
            • requirement is not satisfiedCode-Review
            • requirement is not satisfiedNo-Unresolved-Comments
            • requirement is not satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
            Gerrit-Change-Number: 7899615
            Gerrit-PatchSet: 18
            Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
            Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
            Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
            Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
            Gerrit-CC: Menard, Alexis <alexis...@intel.com>
            Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
            Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
            Gerrit-Attention: Stefan Zager <sza...@chromium.org>
            Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
            Gerrit-Comment-Date: Fri, 10 Jul 2026 00:15:32 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: No
            Comment-In-Reply-To: Stephen Chenney <sche...@chromium.org>
            Comment-In-Reply-To: Philip Rogers <p...@chromium.org>
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            Stephen Chenney (Gerrit)

            unread,
            Jul 12, 2026, 9:48:17 PM (6 days ago) Jul 12
            to Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
            Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

            Stephen Chenney added 3 comments

            Commit Message
            Line 20, Patchset 18:* The style based relied on suppressing autofill data at the getter stage, rather than on setting. I think a setter approach is more robust to future changes.
            Philip Rogers . resolved

            nit: wrap

            Stephen Chenney

            Done

            File third_party/blink/renderer/core/dom/node.cc
            Line 3824, Patchset 18: // Only set canvas subtree state for elements that are participating in
            Philip Rogers . resolved
            Stephen Chenney

            This test passes without the change, after fixing errors with the test case.

            Line 3838, Patchset 18: element->DetachOverscroll();
            Philip Rogers . resolved
            Stephen Chenney

            The test case has errors, but after fixing the test it works. A canvas cannot be the parent of a slot.

            Open in Gerrit

            Related details

            Attention is currently required from:
            • Philip Rogers
            • Rune Lillesveen
            • Stefan Zager
            Submit Requirements:
              • requirement satisfiedCode-Coverage
              • requirement satisfiedCode-Owners
              • requirement is not satisfiedCode-Review
              • requirement is not satisfiedReview-Enforcement
              Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
              Gerrit-MessageType: comment
              Gerrit-Project: chromium/src
              Gerrit-Branch: main
              Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
              Gerrit-Change-Number: 7899615
              Gerrit-PatchSet: 19
              Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
              Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
              Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
              Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
              Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
              Gerrit-CC: Menard, Alexis <alexis...@intel.com>
              Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
              Gerrit-Attention: Philip Rogers <p...@chromium.org>
              Gerrit-Attention: Stefan Zager <sza...@chromium.org>
              Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
              Gerrit-Comment-Date: Mon, 13 Jul 2026 01:48:06 +0000
              Gerrit-HasComments: Yes
              Gerrit-Has-Labels: No
              Comment-In-Reply-To: Philip Rogers <p...@chromium.org>
              satisfied_requirement
              unsatisfied_requirement
              open
              diffy

              Philip Rogers (Gerrit)

              unread,
              Jul 13, 2026, 5:47:03 PM (6 days ago) Jul 13
              to Stephen Chenney, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
              Attention needed from Rune Lillesveen, Stefan Zager and Stephen Chenney

              Philip Rogers voted and added 1 comment

              Votes added by Philip Rogers

              Code-Review+1

              1 comment

              Patchset-level comments
              File-level comment, Patchset 20 (Latest):
              Philip Rogers . resolved

              LGTM!

              Open in Gerrit

              Related details

              Attention is currently required from:
              • Rune Lillesveen
              • Stefan Zager
              • Stephen Chenney
              Submit Requirements:
                • requirement satisfiedCode-Coverage
                • requirement satisfiedCode-Owners
                • requirement satisfiedCode-Review
                • requirement satisfiedReview-Enforcement
                Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                Gerrit-MessageType: comment
                Gerrit-Project: chromium/src
                Gerrit-Branch: main
                Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
                Gerrit-Change-Number: 7899615
                Gerrit-PatchSet: 20
                Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
                Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
                Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
                Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
                Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
                Gerrit-CC: Menard, Alexis <alexis...@intel.com>
                Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
                Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
                Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                Gerrit-Comment-Date: Mon, 13 Jul 2026 21:46:48 +0000
                Gerrit-HasComments: Yes
                Gerrit-Has-Labels: Yes
                satisfied_requirement
                open
                diffy

                Philip Rogers (Gerrit)

                unread,
                Jul 13, 2026, 5:49:54 PM (6 days ago) Jul 13
                to Stephen Chenney, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
                Attention needed from Rune Lillesveen, Stefan Zager and Stephen Chenney

                Philip Rogers voted and added 1 comment

                Votes added by Philip Rogers

                Code-Review+0

                1 comment

                Patchset-level comments
                Philip Rogers . resolved

                Hold on, a few comments

                Open in Gerrit

                Related details

                Attention is currently required from:
                • Rune Lillesveen
                • Stefan Zager
                • Stephen Chenney
                Submit Requirements:
                  • requirement satisfiedCode-Coverage
                  • requirement satisfiedCode-Owners
                  • requirement is not satisfiedCode-Review
                  • requirement is not satisfiedReview-Enforcement
                  Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                  Gerrit-MessageType: comment
                  Gerrit-Project: chromium/src
                  Gerrit-Branch: main
                  Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
                  Gerrit-Change-Number: 7899615
                  Gerrit-PatchSet: 20
                  Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
                  Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
                  Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
                  Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
                  Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
                  Gerrit-CC: Menard, Alexis <alexis...@intel.com>
                  Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
                  Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
                  Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                  Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                  Gerrit-Comment-Date: Mon, 13 Jul 2026 21:49:40 +0000
                  Gerrit-HasComments: Yes
                  Gerrit-Has-Labels: Yes
                  satisfied_requirement
                  unsatisfied_requirement
                  open
                  diffy

                  Philip Rogers (Gerrit)

                  unread,
                  Jul 13, 2026, 8:19:46 PM (5 days ago) Jul 13
                  to Stephen Chenney, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
                  Attention needed from Rune Lillesveen, Stefan Zager and Stephen Chenney

                  Philip Rogers added 5 comments

                  File third_party/blink/renderer/core/dom/element.cc
                  Line 4406, Patchset 20 (Latest): if (IsA<HTMLCanvasElement>(*this)) {
                  Philip Rogers . unresolved
                  Did we lose an early-out here?
                  ```
                  void Element::SetIsCanvasOrInCanvasSubtree(bool value) {
                  value = value || IsA<HTMLCanvasElement>(*this);
                  if (value == IsCanvasOrInCanvasSubtree()) {
                  return;
                  }
                  ```

                  Without `value == IsCanvasOrInCanvasSubtree()`, we'll have a performance regression.

                  File third_party/blink/renderer/core/dom/node.cc
                  Line 3838, Patchset 18: element->DetachOverscroll();
                  Philip Rogers . unresolved
                  Philip Rogers

                  A canvas cannot be the parent of a slot.

                  Is this true? For example, these seem the same to me:

                  case a, div parent of slot:
                  ```
                  <my-widget-a>
                  <template shadowrootmode="open">
                  <!-- The div directly hosts any light DOM content slotted into it -->
                  <div>
                  this is slotted:[
                  <slot name="content-a"></slot>
                  ]
                  </div>
                  </template>
                  <div slot="content-a" id="slotted_child_a">Slotted Content A</div>
                  </my-widget-a>
                  ```
                  case b, canvas parent of slot:
                  ```
                  <my-widget-b>
                  <template shadowrootmode="open">
                  <!-- The canvas directly hosts any light DOM content slotted into it -->
                  <canvas layoutsubtree>
                  <slot name="content-b"></slot>
                  </canvas>
                  </template>
                  <div slot="content-b" id="slotted_child_b">Slotted Content B</div>
                  </my-widget-b>
                  ```

                  If these are indeed the same and if direct children of canvas should be slotted, we need to add:
                  ```
                  // Returns the flat tree parent element, skipping over any HTMLSlotElements.
                  static Element* ParentElementSkippingSlots(const Node&);

                  Element* FlatTreeTraversal::ParentElementSkippingSlots(const Node& node) {
                  Element* parent = ParentElement(node);
                  while (parent && IsA<HTMLSlotElement>(parent)) {
                  parent = ParentElement(*parent);
                  }
                  return parent;
                  }
                  ```
                  And update:
                  1. VerifyDrawElementImageEligibility in third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
                  ```
                  - if (element->parentElement() != this) {
                  + const Element* parent =
                  + FlatTreeTraversal::ParentElementSkippingSlots(*element);
                  + if (parent != this) {
                  ```
                  2. DirectReasonsForPaintProperties in third_party/blink/renderer/core/paint/compositing/compositing_reason_finder.cc
                  ```
                  - auto* canvas_parent =
                  - DynamicTo<HTMLCanvasElement>(element->parentElement());
                  + const Element* parent =
                  + FlatTreeTraversal::ParentElementSkippingSlots(*element);
                  + auto* canvas_parent = DynamicTo<HTMLCanvasElement>(parent);
                  ```
                  3. ForceStackingAndContainingBlockForCanvasLayoutSubtree in third_party/blink/renderer/core/css/resolver/style_adjuster.cc
                  ```
                  - if (const auto* canvas =
                  - DynamicTo<HTMLCanvasElement>(element->parentElement())) {
                  + const Element* parent =
                  + FlatTreeTraversal::ParentElementSkippingSlots(*element);
                  + if (const auto* canvas = DynamicTo<HTMLCanvasElement>(parent)) {
                  ```
                  4. PopulateCanvasChildState in third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
                  ```
                  +static HTMLCanvasElement* FindCanvasParent(const LayoutObject& object) {
                  + const Element* element = DynamicTo<Element>(object.GetNode());
                  + if (!element) {
                  + return nullptr;
                  + }
                  + const Element* parent =
                  + FlatTreeTraversal::ParentElementSkippingSlots(*element);
                  + return DynamicTo<HTMLCanvasElement>(const_cast<Element*>(parent));
                  +}
                  +
                  static void PopulateCanvasChildState(const LayoutObject& object,
                  EffectPaintPropertyNode::State& state) {
                  CHECK(IsA<LayoutBox>(object));
                  - auto& canvas_fragment = object.Parent()->FirstFragment();
                  + HTMLCanvasElement* canvas = FindCanvasParent(object);
                  + CHECK(canvas && canvas->GetLayoutObject());
                  + auto& canvas_fragment = canvas->GetLayoutObject()->FirstFragment();
                  ```
                  Here's the test for the compositing reason finder case which will pass with this change:
                  ```
                  TEST_P(CompositingReasonFinderTest, CanvasChildSlotted) {
                  ScopedCanvasDrawElementForTest forced_canvas_draw_element_feature(true);
                  GetDocument().GetSettings()->SetScriptEnabled(true);
                  SetBodyInnerHTML(R"HTML(
                  <div id="host">
                  <div id="slotted" slot="s1" style="width: 10px; height: 10px;"></div>
                  </div>
                  )HTML");
                  auto* host = GetDocument().getElementById(AtomicString("host"));
                  ASSERT_TRUE(host);
                  ShadowRoot& shadow_root =
                  host->AttachShadowRootForTesting(ShadowRootMode::kOpen);
                  shadow_root.SetInnerHTMLWithoutTrustedTypes(R"HTML(

                  <canvas id="canvas" layoutsubtree>
                  <slot name="s1"></slot>
                  </canvas>
                    )HTML");
                  UpdateAllLifecyclePhasesForTest();
                    Element* slotted = GetElementById("slotted");
                  ASSERT_TRUE(slotted);
                  EXPECT_TRUE(slotted->IsInCanvasSubtree());
                  EXPECT_TRUE(slotted->IsCanvasOrInCanvasSubtree());
                  LayoutObject* layout_object = slotted->GetLayoutObject();
                  ASSERT_TRUE(layout_object);
                  EXPECT_REASONS(CompositingReason::kCanvasChild,
                  CompositingReasonFinder::DirectReasonsForPaintProperties(
                  *layout_object));
                  }
                  ```

                  I think case b, above, is the canonical way that content will be slotted into canvas. If that is true, can you also add a WPT test of that scenario?

                  File third_party/blink/renderer/core/exported/web_form_control_element_test.cc
                  Line 236, Patchset 20 (Latest): EXPECT_TRUE(input.Unwrap<HTMLInputElement>()->IsInCanvasSubtree());
                  Philip Rogers . unresolved

                  Remove this line (this is tested on line 238)

                  Line 538, Patchset 20 (Latest): // Because of bug 1, the inner element flags are not set to true, remaining
                  Philip Rogers . unresolved

                  nit: remove "Because of bug 1, "

                  File third_party/blink/renderer/core/html/html_slot_element.h
                  Line 58, Patchset 20 (Latest): const HeapVector<Member<Node>>& AssignedNodesNoRecalc() const {
                  Philip Rogers . unresolved

                  WDYT of this comment?
                  ```
                  // Use AssignedNodes() in almost all cases. Only use AssignedNodesNoRecalc()
                  // when calling RecalcAssignment() is forbidden or dangerous (e.g., during tree
                  // modifications, moveBefore semantics, or state propagation like
                  // Element::SetIsCanvasOrInCanvasSubtree where eventual consistency is
                  // guaranteed by subsequent FlatTreeParentChanged/RemovedFromFlatTree hooks).
                  ```

                  Open in Gerrit

                  Related details

                  Attention is currently required from:
                  • Rune Lillesveen
                  • Stefan Zager
                  • Stephen Chenney
                  Submit Requirements:
                    • requirement satisfiedCode-Coverage
                    • requirement satisfiedCode-Owners
                    • requirement is not satisfiedCode-Review
                    • requirement is not satisfiedNo-Unresolved-Comments
                    • requirement is not satisfiedReview-Enforcement
                    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                    Gerrit-MessageType: comment
                    Gerrit-Project: chromium/src
                    Gerrit-Branch: main
                    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
                    Gerrit-Change-Number: 7899615
                    Gerrit-PatchSet: 20
                    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
                    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
                    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
                    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
                    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
                    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
                    Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
                    Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Comment-Date: Tue, 14 Jul 2026 00:19:33 +0000
                    Gerrit-HasComments: Yes
                    Gerrit-Has-Labels: No
                    satisfied_requirement
                    unsatisfied_requirement
                    open
                    diffy

                    Stephen Chenney (Gerrit)

                    unread,
                    Jul 14, 2026, 2:48:43 PM (5 days ago) Jul 14
                    to Philip Rogers, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
                    Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

                    Stephen Chenney added 5 comments

                    File third_party/blink/renderer/core/dom/element.cc
                    Line 4406, Patchset 20 (Latest): if (IsA<HTMLCanvasElement>(*this)) {
                    Philip Rogers . unresolved
                    Did we lose an early-out here?
                    ```
                    void Element::SetIsCanvasOrInCanvasSubtree(bool value) {
                    value = value || IsA<HTMLCanvasElement>(*this);
                    if (value == IsCanvasOrInCanvasSubtree()) {
                    return;
                    }
                    ```

                    Without `value == IsCanvasOrInCanvasSubtree()`, we'll have a performance regression.

                    Stephen Chenney

                    I tried to keep the early out. I wrote a DCHECK-enabled verifier to make sure that if we early outed the subtree was correct. That revealed the need to still process the children, so we can't early out.

                    Now maybe we can still early out if we call this method on a different element at the various call sites, like on the slotted thing and not the slot or something similar. If we try that we definitely need the verifier in place. I would leave it for a follow up where I also try to reduce the cost of Element::IsInCanvasSubtree().

                    File third_party/blink/renderer/core/dom/node.cc
                    Stephen Chenney

                    Mmm, you're right that by spec a `<canvas>` can be the parent of a `<slot>`. I was mistakenly thinking of a `<template>` element not allowed as a canvas direct child. But `HTMLSlotElement::Assign(const HeapVector<Member<Node>>& nodes)` is never called when the slot is a child of the canvas, so in practice we might not support it. I'll poke some more to figure out what's happening.

                    File third_party/blink/renderer/core/exported/web_form_control_element_test.cc
                    Line 236, Patchset 20 (Latest): EXPECT_TRUE(input.Unwrap<HTMLInputElement>()->IsInCanvasSubtree());
                    Philip Rogers . resolved

                    Remove this line (this is tested on line 238)

                    Stephen Chenney

                    Done

                    Line 538, Patchset 20 (Latest): // Because of bug 1, the inner element flags are not set to true, remaining
                    Philip Rogers . resolved

                    nit: remove "Because of bug 1, "

                    Stephen Chenney

                    Done

                    File third_party/blink/renderer/core/html/html_slot_element.h
                    Line 58, Patchset 20 (Latest): const HeapVector<Member<Node>>& AssignedNodesNoRecalc() const {
                    Philip Rogers . resolved

                    WDYT of this comment?
                    ```
                    // Use AssignedNodes() in almost all cases. Only use AssignedNodesNoRecalc()
                    // when calling RecalcAssignment() is forbidden or dangerous (e.g., during tree
                    // modifications, moveBefore semantics, or state propagation like
                    // Element::SetIsCanvasOrInCanvasSubtree where eventual consistency is
                    // guaranteed by subsequent FlatTreeParentChanged/RemovedFromFlatTree hooks).
                    ```

                    Stephen Chenney

                    Done

                    Open in Gerrit

                    Related details

                    Attention is currently required from:
                    • Philip Rogers
                    • Rune Lillesveen
                    • Stefan Zager
                    Submit Requirements:
                    • requirement satisfiedCode-Coverage
                    • requirement satisfiedCode-Owners
                    • requirement is not satisfiedCode-Review
                    • requirement is not satisfiedNo-Unresolved-Comments
                    • requirement is not satisfiedReview-Enforcement
                    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                    Gerrit-MessageType: comment
                    Gerrit-Project: chromium/src
                    Gerrit-Branch: main
                    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
                    Gerrit-Change-Number: 7899615
                    Gerrit-PatchSet: 20
                    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
                    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
                    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
                    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
                    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
                    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
                    Gerrit-Attention: Philip Rogers <p...@chromium.org>
                    Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Comment-Date: Tue, 14 Jul 2026 18:48:32 +0000
                    satisfied_requirement
                    unsatisfied_requirement
                    open
                    diffy

                    Philip Rogers (Gerrit)

                    unread,
                    Jul 14, 2026, 3:43:06 PM (5 days ago) Jul 14
                    to Stephen Chenney, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
                    Attention needed from Rune Lillesveen, Stefan Zager and Stephen Chenney

                    Philip Rogers added 1 comment

                    File third_party/blink/renderer/core/dom/element.cc
                    Line 4406, Patchset 20 (Latest): if (IsA<HTMLCanvasElement>(*this)) {
                    Philip Rogers . unresolved
                    Did we lose an early-out here?
                    ```
                    void Element::SetIsCanvasOrInCanvasSubtree(bool value) {
                    value = value || IsA<HTMLCanvasElement>(*this);
                    if (value == IsCanvasOrInCanvasSubtree()) {
                    return;
                    }
                    ```

                    Without `value == IsCanvasOrInCanvasSubtree()`, we'll have a performance regression.

                    Stephen Chenney

                    I tried to keep the early out. I wrote a DCHECK-enabled verifier to make sure that if we early outed the subtree was correct. That revealed the need to still process the children, so we can't early out.

                    Now maybe we can still early out if we call this method on a different element at the various call sites, like on the slotted thing and not the slot or something similar. If we try that we definitely need the verifier in place. I would leave it for a follow up where I also try to reduce the cost of Element::IsInCanvasSubtree().

                    Philip Rogers

                    The calls to `SetIsCanvasOrInCanvasSubtree` are not guarded by the feature flag, so this change will result in a significant perf regression.

                    Can you see if a testcase can be made from the case where the DCHECK verifier was firing which demonstrates a bug? Is it possible that the DCHECK verifier incorrectly fired due the calls to SetIsCanvasOrInCanvasSubtree during slotting? Or, is it possible that the DCHECK verifier was firing due to one of the bugs we've subsequently fixed? Maybe best to investigate this after the canvas-slot fix.

                    Open in Gerrit

                    Related details

                    Attention is currently required from:
                    • Rune Lillesveen
                    • Stefan Zager
                    • Stephen Chenney
                    Submit Requirements:
                    • requirement satisfiedCode-Coverage
                    • requirement satisfiedCode-Owners
                    • requirement is not satisfiedCode-Review
                    • requirement is not satisfiedNo-Unresolved-Comments
                    • requirement is not satisfiedReview-Enforcement
                    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                    Gerrit-MessageType: comment
                    Gerrit-Project: chromium/src
                    Gerrit-Branch: main
                    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
                    Gerrit-Change-Number: 7899615
                    Gerrit-PatchSet: 20
                    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
                    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
                    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
                    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
                    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
                    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
                    Gerrit-Attention: Stephen Chenney <sche...@chromium.org>
                    Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Comment-Date: Tue, 14 Jul 2026 19:42:38 +0000
                    satisfied_requirement
                    unsatisfied_requirement
                    open
                    diffy

                    Stephen Chenney (Gerrit)

                    unread,
                    Jul 18, 2026, 6:34:52 PM (13 hours ago) Jul 18
                    to Philip Rogers, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
                    Attention needed from Rune Lillesveen and Stefan Zager

                    Stephen Chenney voted Commit-Queue+1

                    Commit-Queue+1
                    Open in Gerrit

                    Related details

                    Attention is currently required from:
                    • Rune Lillesveen
                    • Stefan Zager
                    Submit Requirements:
                    • requirement satisfiedCode-Coverage
                    • requirement satisfiedCode-Owners
                    • requirement is not satisfiedCode-Review
                    • requirement is not satisfiedNo-Unresolved-Comments
                    • requirement is not satisfiedReview-Enforcement
                    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                    Gerrit-MessageType: comment
                    Gerrit-Project: chromium/src
                    Gerrit-Branch: main
                    Gerrit-Change-Id: I261f0c55c3e7204ff919f3e64a9655c6f93e47e4
                    Gerrit-Change-Number: 7899615
                    Gerrit-PatchSet: 22
                    Gerrit-Owner: Stephen Chenney <sche...@chromium.org>
                    Gerrit-Reviewer: Philip Rogers <p...@chromium.org>
                    Gerrit-Reviewer: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Reviewer: Stefan Zager <sza...@chromium.org>
                    Gerrit-Reviewer: Stephen Chenney <sche...@chromium.org>
                    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
                    Gerrit-CC: srirama chandra sekhar <srir...@samsung.com>
                    Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Comment-Date: Sat, 18 Jul 2026 22:34:39 +0000
                    Gerrit-HasComments: No
                    Gerrit-Has-Labels: Yes
                    satisfied_requirement
                    unsatisfied_requirement
                    open
                    diffy

                    Stephen Chenney (Gerrit)

                    unread,
                    Jul 18, 2026, 6:36:08 PM (13 hours ago) Jul 18
                    to Philip Rogers, Stefan Zager, Menard, Alexis, srirama chandra sekhar, android-bu...@system.gserviceaccount.com, Rune Lillesveen, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, apavlo...@chromium.org, eric.c...@apple.com, feature-me...@chromium.org, blink-re...@chromium.org, blink-re...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-...@chromium.org
                    Attention needed from Philip Rogers, Rune Lillesveen and Stefan Zager

                    Stephen Chenney added 1 comment

                    File third_party/blink/renderer/core/dom/element.cc
                    Line 4406, Patchset 20: if (IsA<HTMLCanvasElement>(*this)) {
                    Philip Rogers . unresolved
                    Did we lose an early-out here?
                    ```
                    void Element::SetIsCanvasOrInCanvasSubtree(bool value) {
                    value = value || IsA<HTMLCanvasElement>(*this);
                    if (value == IsCanvasOrInCanvasSubtree()) {
                    return;
                    }
                    ```

                    Without `value == IsCanvasOrInCanvasSubtree()`, we'll have a performance regression.

                    Stephen Chenney

                    I tried to keep the early out. I wrote a DCHECK-enabled verifier to make sure that if we early outed the subtree was correct. That revealed the need to still process the children, so we can't early out.

                    Now maybe we can still early out if we call this method on a different element at the various call sites, like on the slotted thing and not the slot or something similar. If we try that we definitely need the verifier in place. I would leave it for a follow up where I also try to reduce the cost of Element::IsInCanvasSubtree().

                    Philip Rogers

                    The calls to `SetIsCanvasOrInCanvasSubtree` are not guarded by the feature flag, so this change will result in a significant perf regression.

                    Can you see if a testcase can be made from the case where the DCHECK verifier was firing which demonstrates a bug? Is it possible that the DCHECK verifier incorrectly fired due the calls to SetIsCanvasOrInCanvasSubtree during slotting? Or, is it possible that the DCHECK verifier was firing due to one of the bugs we've subsequently fixed? Maybe best to investigate this after the canvas-slot fix.

                    Stephen Chenney

                    The verifier had some issues, now fixed. So it's now enabled for all DCHECK builds and doesn't cause and unit tests to fail.

                    Open in Gerrit

                    Related details

                    Attention is currently required from:
                    • Philip Rogers
                    • Rune Lillesveen
                    • Stefan Zager
                    Gerrit-Attention: Philip Rogers <p...@chromium.org>
                    Gerrit-Attention: Stefan Zager <sza...@chromium.org>
                    Gerrit-Attention: Rune Lillesveen <fut...@chromium.org>
                    Gerrit-Comment-Date: Sat, 18 Jul 2026 22:35:55 +0000
                    satisfied_requirement
                    unsatisfied_requirement
                    open
                    diffy
                    Reply all
                    Reply to author
                    Forward
                    0 new messages