Demo works in Chrome Canary but not FF Nightly: http://jsbin.com/kimob/1/edit EXPECTED <h1> content should change from 'foo' to 'bar'. ACTUAL <h1> disappears.
Created attachment 8426829 [details] [diff] [review] Update flattened tree to correctly handle nodes distributed into Shadow DOM insertion points. This bug is caused by GetFlattenedTreeParent() not handling distributed nodes correctly causing the frame constructor to not set the NODE_DESCENDANTS_NEED_FRAMES flag when needed.
Thanks for the patch, William. UX is watching this closely for BB and web components work. How is review coming along? Thanks!
I have a similar problem with elements disappearing when I alter their overflow property, but unfortunately this patch doesn't fix that. Altering the linked test-case to change overflow to hidden instead of textContent causes Nightly to crash (without this patch applied, though).
Said crashing test-case: http://jsbin.com/tutixipa/1/edit
Comment on attachment 8426829 [details] [diff] [review] Update flattened tree to correctly handle nodes distributed into Shadow DOM insertion points. (The change to ExplicitChildIterator::Get() isn't really about this bug.) I'm a bit worried about making GetFlattenedTreeParent to always do a virtual call, but perhaps it isn't too bad...
sorry had to backout this csets in https://tbpl.mozilla.org/?tree=Mozilla-Inbound&onlyunstarred=1&rev=24743a3a0f91 since i guess that one of this 2 changes caused https://tbpl.mozilla.org/php/getParsedLog.php?id=41007049&tree=Mozilla-Inbound
The test case failed on b2g-emu due to an unrelated bug, fixed by making a trivial change to text content in the test. https://hg.mozilla.org/integration/mozilla-inbound/rev/845420c23256
I'm still seeing this issue in some cases. Can't narrow down the exact steps to reproduce yet.