Bug 232409

Summary: Assertions in findFirstSlotElement hit when removing two slots with the same name in a single shadow tree
Product: WebKit Reporter: Gabriel Nava Marino <gnavamarino>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, esprehn+autocc, ews-watchlist, kangil.han, koivisto, rniwa, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 148695    
Attachments:
Description Flags
Patch
none
Patch none

Description Gabriel Nava Marino 2021-10-27 15:42:47 PDT
The proposed changes are related to bug 229748.
Comment 1 Gabriel Nava Marino 2021-10-27 15:50:12 PDT
Created attachment 442641 [details]
Patch
Comment 2 Ryosuke Niwa 2021-10-27 15:55:54 PDT
Comment on attachment 442641 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=442641&action=review

> LayoutTests/fast/shadow-dom/slot-removal-same-name.html:1
> +<script>

Missing DOCTYPE?

> LayoutTests/fast/shadow-dom/slot-removal-same-name.html:3
> +    let shadow0 = document.body.attachShadow({mode: 'open'});

Can we call this just shadowRoot?
Also, use const since we're reassigning another value to it.

> LayoutTests/fast/shadow-dom/slot-removal-same-name.html:6
> +    document.body.offsetTop;

document.body.getBoundingClientRect() is more sure way of ensuring updating the layout.
offsetTop can be optimized in some cases.
Comment 3 Gabriel Nava Marino 2021-10-27 16:08:25 PDT
Created attachment 442644 [details]
Patch
Comment 4 Gabriel Nava Marino 2021-10-27 16:09:07 PDT
Address feedback comments.
Comment 5 EWS 2021-10-27 19:20:55 PDT
Committed r284969 (243620@main): <https://commits.webkit.org/243620@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 442644 [details].
Comment 6 Radar WebKit Bug Importer 2021-10-27 19:21:30 PDT
<rdar://problem/84738513>