diff --git a/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc b/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc index 045dc043a265e..378225e1159c1 100644 --- a/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc +++ b/third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc @@ -487,8 +487,15 @@ void MultipleFieldsTemporalInputTypeView::ForwardEvent(Event& event) { void MultipleFieldsTemporalInputTypeView::DisabledAttributeChanged() { EventQueueScope scope; - if (SpinButtonElement* spin_button = GetSpinButtonElement()) - spin_button->ReleaseCapture(); + if (SpinButtonElement* spin_button = GetSpinButtonElement()) { + // This may run inside Node::moveBefore() via + // HTMLFieldSetElement::ChildrenChanged(); skip dispatching the change event + // in that case so that author script does not run during the atomic move. + spin_button->ReleaseCapture( + GetElement().GetDocument().StatePreservingAtomicMoveInProgress() + ? SpinButtonElement::kEventDispatchDisallowed + : SpinButtonElement::kEventDispatchAllowed); + } if (DateTimeEditElement* edit = GetDateTimeEditElement()) edit->DisabledStateChanged(); } @@ -542,8 +549,12 @@ void MultipleFieldsTemporalInputTypeView::MinOrMaxAttributeChanged() { void MultipleFieldsTemporalInputTypeView::ReadonlyAttributeChanged() { EventQueueScope scope; - if (SpinButtonElement* spin_button = GetSpinButtonElement()) - spin_button->ReleaseCapture(); + if (SpinButtonElement* spin_button = GetSpinButtonElement()) { + spin_button->ReleaseCapture( + GetElement().GetDocument().StatePreservingAtomicMoveInProgress() + ? SpinButtonElement::kEventDispatchDisallowed + : SpinButtonElement::kEventDispatchAllowed); + } if (DateTimeEditElement* edit = GetDateTimeEditElement()) edit->ReadOnlyStateChanged(); } diff --git a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc index c7eebf2e73161..bc561678d64bd 100644 --- a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc +++ b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc @@ -572,8 +572,15 @@ void TextFieldInputType::ValueAttributeChanged() { } void TextFieldInputType::DisabledOrReadonlyAttributeChanged() { - if (SpinButtonElement* spin_button = GetSpinButtonElement()) - spin_button->ReleaseCapture(); + if (SpinButtonElement* spin_button = GetSpinButtonElement()) { + // This may run inside Node::moveBefore() via + // HTMLFieldSetElement::ChildrenChanged(); skip dispatching the change event + // in that case so that author script does not run during the atomic move. + spin_button->ReleaseCapture( + GetElement().GetDocument().StatePreservingAtomicMoveInProgress() + ? SpinButtonElement::kEventDispatchDisallowed + : SpinButtonElement::kEventDispatchAllowed); + } UpdateWheelEventRegistration(/*is_detaching=*/false); } diff --git a/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/fieldset-child-number-input-change-event.html b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/fieldset-child-number-input-change-event.html new file mode 100644 index 0000000000000..44cb681cb0dcf --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/fieldset-child-number-input-change-event.html @@ -0,0 +1,43 @@ + +moveBefore should not fire change on a number input whose spin button has capture in a disabled fieldset + + + + + + +
+ + + + +
+ +