"has dispatched input event" should only be set for trusted events

[yoavweiss]

"has dispatched input event" is a flag used by LargestContentfulPaint to stop taking candidates into account.
It should be limited to trusted events, to avoid web content from stopping LCP registration by dispatching such events programatically.

[mmocny]

Is this meant to be an Event TIming issue?

(Event timing is already constrained to trusted events see https://w3c.github.io/event-timing/#sec-events-exposed)

[mmocny]

I see now, LCP spec patches HTML to add "has dispatched scroll event" and DOM to set it. But LCP spec relies on Event timing to do likewise for "has dispatched input event"

My read is that Event Timing is already doing what is expected here.

Specifically, the value of "has dispatched input event" is set from Step 6 of https://w3c.github.io/event-timing/#set-event-timing-entry-duration but that is already filtered on isTrusted at that point.

See: https://w3c.github.io/event-timing/#sec-modifications-DOM which calls https://w3c.github.io/event-timing/#initialize-event-timing from step 2, which calls https://w3c.github.io/event-timing/#considered-for-event-timing from step 1

[yoavweiss]

I could be wrong but my read is that isTrusted is taken into account in two places: in considered for EventTiming and in compute interactionId.
But that's not sufficient as the setting of "has dispatched input event" is happening in dispatch pending event timing entries, which is called directly from the update the rendering monkeypatch, without being filtered on isTrusted.