Don't come undone when undoing the editing of a Custom Element.

Don't come undone when undoing the editing of a Custom Element.

CustomElementRegistrationContext hitherto asserted that the parser
would only call setAttribute for the "is" attribute once (or for any
given attribute; but the "is" attribute has special significance
because it governs Custom Element type extensions).

However undoing ReplaceNodeWithSpan may pull an existing Custom
Element out and "parser set" the "is" attribute a second time. This
change weakens the assertion and simply makes subsequent sets of "is"
a no-op.

This defect was found by the fuzzing described in
<http://crbug.com/234509#c40>;.

BUG=234509
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=155612

[dominicc (has gone to gerrit), 2013-08-06 08:24:10]

yutak: PTAL
yosin: FYI since yr ramping up on editing

[Yuta Kitamura, 2013-08-06 09:00:02]

C++ code looks okay but I'm not sure how the added test
would invoke the changed code path.

https://codereview.chromium.org/22320009/diff/1/LayoutTests/fast/dom/custom/t...
File LayoutTests/fast/dom/custom/type-extension-undo-assert.html (right):

https://codereview.chromium.org/22320009/diff/1/LayoutTests/fast/dom/custom/t...
LayoutTests/fast/dom/custom/type-extension-undo-assert.html:3: <div id="test"
contenteditable><b is="x-a" style="font-style: italic;">Hello, world!</b></div>
Correct me if I'm wrong, but this line creates a HTML <b> (bold) element
since the type "x-a" is not registered type?

I don't fully understand how this HTML and execCommands
("bold", "undo" and "undo") could hit the setTypeExtension() function.
Might be better to have comments clarifying the behavior of
this test.

[yosin_UTC9, 2013-08-06 09:06:06]

https://codereview.chromium.org/22320009/diff/1/LayoutTests/fast/dom/custom/t...
File LayoutTests/fast/dom/custom/type-extension-undo-assert.html (right):

https://codereview.chromium.org/22320009/diff/1/LayoutTests/fast/dom/custom/t...
LayoutTests/fast/dom/custom/type-extension-undo-assert.html:5:
description('Tests that execCommand undo doesn\'t hork custom elements');
s/hork/fork/

[Yuta Kitamura, 2013-08-06 09:28:19]

https://codereview.chromium.org/22320009/diff/1/LayoutTests/fast/dom/custom/t...
File LayoutTests/fast/dom/custom/type-extension-undo-assert.html (right):

https://codereview.chromium.org/22320009/diff/1/LayoutTests/fast/dom/custom/t...
LayoutTests/fast/dom/custom/type-extension-undo-assert.html:5:
description('Tests that execCommand undo doesn\'t hork custom elements');
On 2013/08/06 09:06:07, Yoshifumi Inoue wrote:
> s/hork/fork/

I guess this is a witty way of saying "to mess up"
or something like that...
http://en.wiktionary.org/wiki/hork

[dominicc (has gone to gerrit), 2013-08-06 10:07:55]

Yes, I really meant hork.

PTAL--added some commentary about the genesis and mechanism of this test.

[Yuta Kitamura, 2013-08-06 10:18:27]

This is much clearer! LGTM.

[commit-bot: I haz the power, 2013-08-06 11:19:26]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dominicc@chromium.org/22320009/12001

[commit-bot: I haz the power, 2013-08-06 13:58:21]

Change committed as 155612