DOM: moveBefore() still runs the update selectedness algorithm
Per
https://docs.google.com/document/d/1qfYyvdK4zhzloABKeh0K1lHPm-SpnEcsWEE9UdDuoMk/edit, this CL adds tests for select/option/optgroup
move + selectedness semantics.
This CL also fixes a crash in ContainerNode::WillRemoveChildren(), which
is now reachable during an atomic move, via customizable select 1.
When an option element gets text-only rendered as a result of being
removed from a select element, it wipes all of its children, which
could include arbitrary content like iframes. The WillRemoveChildren()
path previously expected to never get called during an atomic move, but
this CL treats it the same as the WillRemoveChild() path, and gates the
child frame disconnector's use on non-SPAM flows.
R=masonf, nrosenthal
Bug: 40150299
Change-Id: I0e1064446b8a0359a62b1be152fec22fc9a583b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5921538
Commit-Queue: Dominic Farolino dom@chromium.org
Reviewed-by: Noam Rosenthal nrosenthal@chromium.org
Cr-Commit-Position: refs/heads/main@{#1366923}