Fix crash when removing stylesheets from shadow tree.

Fix crash when removing stylesheets from shadow tree.

The added sheets passed into StyleSheetInvalidationAnalysis may either be
added or removed. When they are removed style elements from a shadow tree,
the style element may no longer have a containingShadowRoot if the element
has already been removed. That caused a crash when the containingShadowRoot
was accessed without a nullptr check.

Instead of deducing the scope from the style element, pass the stylesheet
collection TreeScope to the analysis object. The m_scopingNodes, which is
probably a left-over from <style scoped> has been removed.

Now, the shadow tree root node, or outermost shadow host if ::content
rules makes that necessary, is always marked sub-tree dirty. The previous
code-path could trigger id/class invalidation of separate elements when
the stylesheet contents had multiple owner nodes, but that was most likely
wrong if it could ever happen.

BUG=522860
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=201058

[rune, 2015-08-23 14:20:53]

The CQ bit was checked by rune@opera.com to run a CQ dry run

[commit-bot: I haz the power, 2015-08-23 14:20:57]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1313443003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1313443003/1

[esprehn, 2015-08-23 15:34:51]

esprehn@chromium.org changed reviewers:
+ esprehn@chromium.org

[esprehn, 2015-08-23 15:34:52]

lgtm w/ fixes.

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
File Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp (right):

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp:180: static
ContainerNode* outermostShadowHost(const ShadowRoot& root)
Do you actually want the outer most host or the rootInTreeOfTrees?

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp:182:
ContainerNode* host = root.shadowHost();
.host()

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp:184: host =
host->containingShadowRoot()->shadowHost();
->host(), that's all the shadowHost() call here is doing, just with a null check
that's not needed.

[commit-bot: I haz the power, 2015-08-23 18:47:32]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-23 18:47:33]

Dry run: Try jobs failed on following builders:
  linux_android_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_android_r...)

[rune, 2015-08-23 20:21:47]

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
File Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp (right):

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp:180: static
ContainerNode* outermostShadowHost(const ShadowRoot& root)
On 2015/08/23 15:34:51, esprehn wrote:
> Do you actually want the outer most host or the rootInTreeOfTrees?

rootInTreeOfTrees is document() as long as the node we're looking at is
inDocument(). Which is further up than necessary. A node which may be directly
distributed, or indirectly as a descendant of a distributed node, down through
shadow trees must have a shadow host ascendant in order to be distributed at
all. I've added another testcase to fast/css/invalidation to illustrate with an
invalidation count (and which fails if we don't walk up the tree to the
outermost host).

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp:182:
ContainerNode* host = root.shadowHost();
On 2015/08/23 15:34:52, esprehn wrote:
> .host()

Done.

https://codereview.chromium.org/1313443003/diff/1/Source/core/css/invalidatio...
Source/core/css/invalidation/StyleSheetInvalidationAnalysis.cpp:184: host =
host->containingShadowRoot()->shadowHost();
On 2015/08/23 15:34:51, esprehn wrote:
> ->host(), that's all the shadowHost() call here is doing, just with a null
check
> that's not needed.

Done.

[rune, 2015-08-23 20:22:32]

The CQ bit was checked by rune@opera.com

[rune, 2015-08-23 20:22:33]

The patchset sent to the CQ was uploaded after l-g-t-m from esprehn@chromium.org
Link to the patchset: https://codereview.chromium.org/1313443003/#ps20001
(title: "Addressed review issues and added test.")

[commit-bot: I haz the power, 2015-08-23 20:22:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1313443003/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1313443003/20001

[commit-bot: I haz the power, 2015-08-23 22:02:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-23 22:02:16]

Try jobs failed on following builders:
  mac_chromium_rel_ng on tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[rune, 2015-08-23 22:19:51]

The CQ bit was checked by rune@opera.com

[commit-bot: I haz the power, 2015-08-23 22:19:54]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1313443003/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1313443003/20001

[commit-bot: I haz the power, 2015-08-23 23:45:49]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-23 23:45:49]

Try jobs failed on following builders:
  mac_chromium_rel_ng on tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[rune, 2015-08-24 10:38:37]

The CQ bit was checked by rune@opera.com

[commit-bot: I haz the power, 2015-08-24 10:38:45]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1313443003/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1313443003/20001

[commit-bot: I haz the power, 2015-08-24 11:32:57]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=201058