Bug 100455

Summary:

[Shadow]: removing styles in shadow dom subtree causes crash.

Product:

WebKit

Reporter:

Takashi Sakamoto <tasak>

Component:

WebCore Misc.

Assignee:

Takashi Sakamoto <tasak>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

d-r, gustavo, morrita, philn, tasak, webkit.review.bot, xan.lopez

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

88606

Attachments:

Description	Flags
repro.html	none
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none

Takashi Sakamoto

Reported 2012-10-25 21:32:14 PDT

Created attachment 170806 [details] repro.html The bug 100246, https://bugs.webkit.org/show_bug.cgi?id=100246, has already reported this as "The new test fast/dom/shadow/athost-atrules.html is crashing on our debug bot". If shadow root has more than two styles and the styles are not direct children of the shadow root, removing the styles causes crashing. For example, <#shadow-root> <div> <style>span { color: red; }</style> <span>Hello</span> </div> <div> <style>.world { color: blue; } </style> <span class="world">World</span> </div> </#shadow-root> So when removing <style>s (e.g. do shadowroot.innerHTML="" or something), chrome/DumpRenderTree crashes.

Attachments
repro.html (398 bytes, text/html) 2012-10-25 21:32 PDT, Takashi Sakamoto	no flags	Details
Patch (7.63 KB, patch) 2012-10-25 23:17 PDT, Takashi Sakamoto	no flags	Details Formatted Diff Diff
Patch (11.25 KB, patch) 2012-10-26 01:09 PDT, Takashi Sakamoto	no flags	Details Formatted Diff Diff
Patch (12.55 KB, patch) 2012-10-26 01:33 PDT, Takashi Sakamoto	no flags	Details Formatted Diff Diff
Patch (10.50 KB, patch) 2012-10-26 02:16 PDT, Takashi Sakamoto	no flags	Details Formatted Diff Diff
Patch (11.03 KB, patch) 2012-10-26 02:57 PDT, Takashi Sakamoto	no flags	Details Formatted Diff Diff
Show Obsolete (4) View All Add attachment proposed patch, testcase, etc.