Stack trace:

#9 0x7f67faa29f57 blink::hasEditableStyle()
#10 0x7f67fad4d433 blink::HTMLElement::matchesReadWritePseudoClass()
#11 0x7f67fa6c421e blink::SelectorChecker::checkPseudoClass()
#12 0x7f67fa6c1415 blink::SelectorChecker::checkOne()
#13 0x7f67fa6c0e66 blink::SelectorChecker::matchSelector()
#14 0x7f67fa65eed0 blink::SelectorChecker::match()
#15 0x7f67fa6c7745 blink::SelectorChecker::match()
#16 0x7f67fa9776a1 blink::SelectorDataList::selectorMatches()
#17 0x7f67fa9799f6 blink::SelectorDataList::executeForTraverseRoot<>()
#18 0x7f67fa979237 blink::SelectorDataList::findTraverseRootsAndExecute<>()
#19 0x7f67fa977da0 blink::SelectorDataList::execute<>()
#20 0x7f67fa9767f5 blink::SelectorDataList::queryAll()
#21 0x7f67fa9769ad blink::SelectorQuery::queryAll()
#22 0x7f67fa7dc3a6 blink::ContainerNode::querySelectorAll()
#23 0x7f67fb8e7d45 blink::ParentNode::querySelectorAll()

In review: http://crrev.com/2531763002

Using computed style for editability is the root cause here. We should not have querySelector rely on clean style.

querySelector()/queryAllSelectors() requires "clean style" only if specified selector contains ":read-write" or ":read-only" rather than all cases. qS() and qAS() don't cause update style in most case, e.g. "#id", "tagName", ".class".

From historical reason, editability is defined in "-webkit-user-modify", CSSWG rejected to "user-modify" proposal, but Firefox, WebKit/Blink implemented.

Current usage of "webkit-user-modify" is 1.6393%[1], so we need year long time to deprecate it.

We can have editability cache to propagate "contenteditable" attribute for tree like style propagation. Firefox has it but Firefox will move contentEditable cache to style system since their mechanism is identical to reduce cost of maintaining contenteditable cache.

There are three options here:
 1. Use dirty style for ":read-write" and ":read-only" query; results are sometimes wrong
 2. Ensure clean style for ":read-write" and ":read-only" case.
 3. If style isn't clean, visit ancestors to check contenteditable attribute
  Use temporary/on-stack ContentEditableCache like NthIndexCache

If we choose option 1, we should do:
 - Start deprecating "webkit-user-modify"
 - Once "webkit-user-modify" removed, we use contenteditable attribute cache.


[1] https://www.chromestatus.com/metrics/css/popularity#webkit-user-modify

Correction. Option 3 doesn't work since we need to check "webkit-user-modify" CSS property.

We want to remove -webkit-user-modify, but we can't since it usage is still high.

WontFix as we are going to deprecate -webkit-use-modify instead.