881339 - CSS child selectors do not match when used in style tags with scoped attribute

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Bryan]

Attachment: scoped.html

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.37 Safari/537.36

Steps to reproduce:

Inside a style tag with the HTML5 scoped attribute, use a child selector (>) that does not include the right-most portion of the selector. Eg: .a>.b .c


Actual results:

The selector does not match when the scoped attribute is present on the style tag. Removing the scoped attribute causes the selector to match as expected. The bug does not reproduce when using a child selector that includes the right-most portion. Eg: .a .b>.c


Expected results:

The selector should match.

Chrome's implementation of the scoped attribute does not reproduce this issue (Chrome behaves as expected). The issue tracking the implementation of the scoped attribute (https://bugzilla.mozilla.org/show_bug.cgi?id=508725#c3) does mention that Chrome's implementation behaves incorrectly in some cases, and I'm unsure if this issue is one of those differences. Attached is a simple HTML document that demonstrates the problem.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Cameron, can you take a look please?  Looks like a bug at first glance...

Comment 2

[Cameron McCormack (:heycam)]

It looks like the issue is that in aTreeMatchContext.PopStyleScopeForSelectorMatching, we call aTreeMatchContext.PopStyleScopeForSelectorMatching() when we move up the tree, but when we fail a recursive call to SelectorMatchesTree (for a descendant selector) we don't restore the state of whether we're still in the style scope.  So we think we've left the style scope when we haven't.

Comment 3

[Cameron McCormack (:heycam)]

(In reply to Cameron McCormack (:heycam) from comment #2)
> It looks like the issue is that in
> aTreeMatchContext.PopStyleScopeForSelectorMatching, we call ...

*in SelectorMatchesTree

Comment 4

[Cameron McCormack (:heycam)]

Attachment: patch

I don't believe we'll ever be in nsCSSRuleProcessor::HasStateDependentStyle or nsCSSRuleProcessor::SelectorListMatches when mForScopedStyle = true, so I've asserted and not done the save/restore of mCurrentScopedStyle in them.

Try run in progress: https://tbpl.mozilla.org/?tree=Try&rev=c71c0f2264d9

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 760726 [details] [diff] [review]
patch

r=me

Comment 6

[Cameron McCormack (:heycam)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/266dcd22cc6e

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/266dcd22cc6e