Changes from hidden to not-hidden are broken too.  See second testcase.

Deleted: baz.html 293 bytes

baz.html 293 bytes View Download

Did this work before? I'm requesting a bisect to ensure that this is not a regression.

Able to reproduce the issue using #61.0.3163.25 on Mac 10.12.5, Linux Ubuntu 14.04, Win 10. Observed the text is in red color.

Below is the bisect info.
========================

Good Build: 50.0.2625.0
Bad Build: 50.0.2626.0

Unable to provide the per-revision-bisect info. Hence providing Chromium bisect.

You are probably looking for a change made after 370096 (known good), but no later than 370097 (first known bad).

CHANGELOG URL
==============

https://chromium.googlesource.com/chromium/src/+log/1b08ddc2f37a6463ee7edc3555cb5b1b4e0d71f9..95eaa0cbb6e9a7d348769a335ae702c1214769dc

rune@ - Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Issue is seen M62 as well.

Thanks!!

Yes, that's plausible. The issue is that after we started using invalidation sets for more specific invalidations, we need to catch the various combinations of attributes which causes the evaluation of pseudo selectors to change. In this case, the evaluation of :required depends on the value of the type attribute. Looking at the code, there seems to be the simlilar issues for other pseudo selectors as well.

https://chromium-review.googlesource.com/c/602027

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/64cae83473fce17e2d013ba1ca89d80b5e08c586

commit 64cae83473fce17e2d013ba1ca89d80b5e08c586
Author: Rune Lillesveen <rune@opera.com>
Date: Mon Aug 07 12:45:59 2017

Evaluation of :required and :optional changes on input type changes.

If an input element changes to or from hidden in the presence of a
"required" attribute, the evaluation of :required and :optional will
change. Schedule invalidation sets to update computed style
appropriately.

Bug:  751406 
Change-Id: I64ccaaa58067594e4a150f80fe73aaf4c9f93c83
Reviewed-on: https://chromium-review.googlesource.com/602027
Commit-Queue: Rune Lillesveen <rune@opera.com>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#492304}
[add] https://crrev.com/64cae83473fce17e2d013ba1ca89d80b5e08c586/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/required-optional-hidden.html
[modify] https://crrev.com/64cae83473fce17e2d013ba1ca89d80b5e08c586/third_party/WebKit/Source/core/html/HTMLInputElement.cpp

Does that patch just fix :required/:optional, or the various other broken pseudo-classes as well?  For example, :read-write matching is also broken; see attachment.

Deleted: bar.html 277 bytes

bar.html 277 bytes View Download

And :placeholder-shown is broken as well.  See attachment.

I can keep guessing which pseudo-classes you have depending on attributes, of course, but it seems like that would be better done by someone who knows the codebase better.

Deleted: bar.html 302 bytes

bar.html 302 bytes View Download

Right. I'll look into the other ones as well.

bzbarsky@: Firefox 54 does not update :placeholder-shown going from e.g. "submit" to "text", but does update the other way round. Known/fixed issue, or should I report? (could not find an existing one).

Known issue; it's tracked in https://bugzilla.mozilla.org/show_bug.cgi?id=1386530

I actually ran into this issue in Blink while writing testcases for that issue and testing how they behave in different browsers.  ;)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/622eab38a8f9300203cb505ad9adc7f027ca588e

commit 622eab38a8f9300203cb505ad9adc7f027ca588e
Author: Rune Lillesveen <rune@opera.com>
Date: Wed Aug 09 10:28:19 2017

Apply :placeholder-shown and :read-write changes on input type change.

Whether :placeholder-shown, :read-only, and :read-write matches an html
input element depends on its type. Apply changes on type attribute
changes accordingly.

The placeholder text and visibility had to be updated sychronously,
otherwise the pseudo invalidation happens before the placeholder
visibility update as part of layout tree attachment.

Bug:  751406 
Change-Id: Ic5bf1c62073cdf2648dfbf7876828323fecfe4be
Reviewed-on: https://chromium-review.googlesource.com/605252
Commit-Queue: Rune Lillesveen <rune@opera.com>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#492935}
[add] https://crrev.com/622eab38a8f9300203cb505ad9adc7f027ca588e/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/placeholder-shown-type-change.html
[add] https://crrev.com/622eab38a8f9300203cb505ad9adc7f027ca588e/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/readwrite-readonly-type-change.html
[modify] https://crrev.com/622eab38a8f9300203cb505ad9adc7f027ca588e/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/required-optional-hidden.html
[modify] https://crrev.com/622eab38a8f9300203cb505ad9adc7f027ca588e/third_party/WebKit/Source/core/html/HTMLInputElement.cpp

Found the same issue with :checked:

https://chromium-review.googlesource.com/c/chromium/src/+/645987

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f2642047d7708f52fffb1eeae4cf06643ff7f687

commit f2642047d7708f52fffb1eeae4cf06643ff7f687
Author: Rune Lillesveen <rune@opera.com>
Date: Fri Sep 01 09:19:48 2017

Update :checked style when input type changes.

The :checked pseudo class only matches for certain input types. We need
to schedule style invalidations for :checked when the input changes
between certain types.

Bug:  751406 
Change-Id: I818b498339a643766e0c619cb6b70bfd09c6efcb
Reviewed-on: https://chromium-review.googlesource.com/645987
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Rune Lillesveen <rune@opera.com>
Cr-Commit-Position: refs/heads/master@{#499156}
[add] https://crrev.com/f2642047d7708f52fffb1eeae4cf06643ff7f687/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/checked-type-change.html
[modify] https://crrev.com/f2642047d7708f52fffb1eeae4cf06643ff7f687/third_party/WebKit/Source/core/html/HTMLInputElement.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f8eb347a09709d0ae8b84bf5f2dfffe670dec552

commit f8eb347a09709d0ae8b84bf5f2dfffe670dec552
Author: Rune Lillesveen <rune@opera.com>
Date: Fri Sep 01 09:27:19 2017

Update :indeterminate style when input type changes.

The :indeterminate pseudo class only matches for certain input types.
We need to schedule style invalidations for :indeterminate when the
input changes between certain types.

Bug:  751406 
Change-Id: I4cae67ce883ec0969119f788718db8b978f9a67d
Reviewed-on: https://chromium-review.googlesource.com/646168
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Rune Lillesveen <rune@opera.com>
Cr-Commit-Position: refs/heads/master@{#499157}
[add] https://crrev.com/f8eb347a09709d0ae8b84bf5f2dfffe670dec552/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/indeterminate-type-change.html
[modify] https://crrev.com/f8eb347a09709d0ae8b84bf5f2dfffe670dec552/third_party/WebKit/Source/core/html/HTMLInputElement.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d117e3d55b9d6adf2b6c125db61ee1ff6e7aa371

commit d117e3d55b9d6adf2b6c125db61ee1ff6e7aa371
Author: Rune Lillesveen <rune@opera.com>
Date: Fri Sep 01 09:37:02 2017

Update :in-range/:out-of-range style when input type changes.

The :in-range/:out-of-range pseudo classes only matches for steppable
input typesi. We need to schedule style invalidations for these pseudo
classes when the input changes and at least one of them is steppable.
Changing between two steppable types may also need invalidation as
min/max/value need to be reparsed and their value may not be valid or
their interpretations may be different.

Bug:  751406 
Change-Id: I0dc6517ded832fdaa63f1a3bdda161dcf2b3b448
Reviewed-on: https://chromium-review.googlesource.com/646327
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Rune Lillesveen <rune@opera.com>
Cr-Commit-Position: refs/heads/master@{#499158}
[add] https://crrev.com/d117e3d55b9d6adf2b6c125db61ee1ff6e7aa371/third_party/WebKit/LayoutTests/external/wpt/html/semantics/selectors/pseudo-classes/inrange-outofrange-type-change.html
[modify] https://crrev.com/d117e3d55b9d6adf2b6c125db61ee1ff6e7aa371/third_party/WebKit/Source/core/html/HTMLInputElement.cpp

I've fixed the issues I've found now.