Don't propagate bits for children invalidated under display:none/not in the flat tree.
Much like invalidated_descendants. This preserves our invariant that we
only visit elements with data in the post-traversal.
Differential Revision: https://phabricator.services.mozilla.com/D160338
bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1797407
gecko-commit: 02e3e61b085b61f5d5aa343503060fc973e09f79
gecko-reviewers: boris, firefox-style-system-reviewers
diff --git a/shadow-dom/invalidate-shadow-dom-crash.html b/shadow-dom/invalidate-shadow-dom-crash.html
new file mode 100644
index 0000000..ebbcabf
--- /dev/null
+++ b/shadow-dom/invalidate-shadow-dom-crash.html
@@ -0,0 +1,12 @@
+<style>
+.c~*{}
+</style>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ b.select()
+ a.className = "c"
+})
+</script>
+<details>
+<summary id="a"></summary>
+<textarea id="b">
