ChangeLog

2012-02-26  MORITA Hajime  <morrita@google.com>

        Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers

        https://bugs.webkit.org/show_bug.cgi?id=72440

        Reviewed by NOBODY (OOPS!).

        This problem was caused by the inconsistent detach order of DOM tree where

        Element::detach() called ContainerNode::detach() before shadow tree is detached.

        This resulted the renderer of the element being destroyed even if its children,

        each of which came from an element in the shadow tree, are alive.

        In principle, child renderers should be destroyed before its parent.

        This change aligns the detach order with the attach order. The shadow tree is

        now deatched before parent's ContainerNode::detach() is called.

        Test: fast/dom/shadow/shadow-ul-li.html

        * dom/Element.cpp:

        (WebCore::Element::detach):

2012-02-26  Adam Barth  <abarth@webkit.org>

        ContextDestructionObserver should live in its own file

Source/WebCore/dom/Element.cpp

@@void Element::detach()

    cancelFocusAppearanceUpdate();

    if (hasRareData())

        rareData()->resetComputedStyle();

    ContainerNode::detach();

    if (ShadowRootList* shadowRoots = shadowRootList())

        shadowRoots->detach();

    if (hasShadowRoot()) {

        for (Node* child = firstChild(); child; child = child->nextSibling()) {

            if (child->attached())

                child->detach();

        }

        shadowRootList()->detach();

        Node::detach();

    } else

        ContainerNode::detach();

    RenderWidget::resumeWidgetHierarchyUpdates();

}

LayoutTests/ChangeLog

2012-02-26  MORITA Hajime  <morrita@google.com>

        Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers

        https://bugs.webkit.org/show_bug.cgi?id=72440

        Reviewed by NOBODY (OOPS!).

        * fast/dom/shadow/shadow-ul-li-expected.txt: Added.

        * fast/dom/shadow/shadow-ul-li.html: Added.

2012-02-26  Yoshifumi Inoue  <yosin@chromium.org>

        LayoutTests/fast/forms/number/input-number-events.html is failing since r108228

LayoutTests/fast/dom/shadow/shadow-ul-li-expected.txt

1PASS unless crash.

LayoutTests/fast/dom/shadow/shadow-ul-li.html

<!DOCTYPE html>

<html>

<head>

<script>

function test()

{

    if (!window.layoutTestController)

        return;  // needs ShadowRoot

    layoutTestController.dumpAsText();

    var host = document.createElement('div');

    document.body.appendChild(host);

    var shadow = internals.ensureShadowRoot(host);

    var ul = document.createElement('ul');

    var li = document.createElement('li');

    ul.appendChild(li);

    shadow.appendChild(ul);

    document.body.offsetLeft;

    document.body.innerHTML = 'PASS unless crash.';

}

</script>

</head>

<body onload="test()">

</body>

</html>