Allow <link rel=stylesheet> in a connected shadow tree

third_party/WebKit/Source/core/html/HTMLLinkElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 115 matching lines @@
             if (LinkStyle* link = linkStyle())
                 link->setSheetTitle(value);
         }
 
         HTMLElement::parseAttribute(name, oldValue, value);
     }
 }
 
 bool HTMLLinkElement::shouldLoadLink()
 {
-    return isConnected();
+    return isInDocumentTree() || (isConnected() && m_relAttribute.isStyleSheet());
 }
 
 bool HTMLLinkElement::loadLink(const String& type, const String& as, const String& media, const KURL& url)
 {
     return m_linkLoader->loadLink(m_relAttribute, crossOriginAttributeValue(fastGetAttribute(HTMLNames::crossoriginAttr)), type, as, media, url, document(), NetworkHintsInterfaceImpl());
 }
 
 LinkResource* HTMLLinkElement::linkResourceToProcess()
 {
-    bool visible = isConnected() && !isInShadowTree();
-    if (!visible) {
+    if (!shouldLoadLink()) {
         ASSERT(!linkStyle() || !linkStyle()->hasSheet());
         return nullptr;
     }
 
     if (!m_link) {
         if (m_relAttribute.isImport()) {
             m_link = LinkImport::create(this);
         } else if (m_relAttribute.isManifest()) {
             m_link = LinkManifest::create(this);
         } else if (RuntimeEnabledFeatures::linkServiceWorkerEnabled() && m_relAttribute.isServiceWorker()) {
@@ skipping 38 matching lines @@
     if (LinkResource* link = linkResourceToProcess())
         link->process();
 }
 
 Node::InsertionNotificationRequest HTMLLinkElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
     logAddElementIfIsolatedWorldAndInDocument("link", relAttr, hrefAttr);
     if (!insertionPoint->isConnected())
         return InsertionDone;
-
-    if (isInShadowTree()) {
+    DCHECK(isConnected());
+    if (!shouldLoadLink()) {
+        DCHECK(isInShadowTree());
         String message = "HTML element <link> is ignored in shadow tree.";
         document().addConsoleMessage(ConsoleMessage::create(JSMessageSource, WarningMessageLevel, message));
         return InsertionDone;
     }
 
     document().styleEngine().addStyleSheetCandidateNode(this);
 
     process();
 
     if (m_link)
         m_link->ownerInserted();
 
     return InsertionDone;
 }
 
 void HTMLLinkElement::removedFrom(ContainerNode* insertionPoint)
 {
-    // Store the result of isInShadowTree() here before Node::removedFrom(..) clears the flags.
-    bool wasInShadowTree = isInShadowTree();
+    // Store the result of isConnected() here before Node::removedFrom(..) clears the flags.
+    bool wasConnected = isConnected();
     HTMLElement::removedFrom(insertionPoint);
     if (!insertionPoint->isConnected())
         return;
 
     m_linkLoader->released();
 
-    if (wasInShadowTree) {
+    if (!wasConnected) {
         ASSERT(!linkStyle() || !linkStyle()->hasSheet());
         return;
     }
     document().styleEngine().removeStyleSheetCandidateNode(this);
 
     StyleSheet* removedSheet = sheet();
 
     if (m_link)
         m_link->ownerRemoved();
 
@@ skipping 189 matching lines @@
 
 enum StyleSheetCacheStatus {
     StyleSheetNewEntry,
     StyleSheetInDiskCache,
     StyleSheetInMemoryCache,
     StyleSheetCacheStatusCount,
 };
 
 void LinkStyle::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CSSStyleSheetResource* cachedStyleSheet)
 {
-    if (!m_owner->isInDocumentTree()) {
-        // While the stylesheet is asynchronously loading, the owner can be moved out of a document tree.
+    if (!m_owner->isConnected()) {
+        // While the stylesheet is asynchronously loading, the owner can be disconnected from a document.
         // In that case, cancel any processing on the loaded content.
         m_loading = false;
         removePendingSheet();
         if (m_sheet)
             clearSheet();
         return;
     }
 
     // See the comment in PendingScript.cpp about why this check is necessary
     // here, instead of in the resource fetcher. https://crbug.com/500701.
@@ skipping 196 matching lines @@
             clearResource();
             clearFetchFollowingCORS();
         }
 
         if (!m_owner->shouldLoadLink())
             return;
 
         m_loading = true;
 
         String title = m_owner->title();
-        if (!title.isEmpty() && !m_owner->isAlternate() && m_disabledState != EnabledViaScript)
+        if (!title.isEmpty() && !m_owner->isAlternate() && m_disabledState != EnabledViaScript && m_owner->isInDocumentTree())
             document().styleEngine().setPreferredStylesheetSetNameIfNotSet(title);
 
         bool mediaQueryMatches = true;
         LocalFrame* frame = loadingFrame();
         if (!m_owner->media().isEmpty() && frame) {
             MediaQuerySet* media = MediaQuerySet::create(m_owner->media());
             MediaQueryEvaluator evaluator(frame);
             mediaQueryMatches = evaluator.eval(media);
         }
 
@@ skipping 51 matching lines @@
 }
 
 DEFINE_TRACE(LinkStyle)
 {
     visitor->trace(m_sheet);
     LinkResource::trace(visitor);
     ResourceOwner<StyleSheetResource>::trace(visitor);
 }
 
 } // namespace blink