Since the shadow host is in a different tree than nodes in its shadow tree, it's incorrect to call removedFrom with the shadow host as the removal point. This bug was revealed while working on the bug 149241.
Created attachment 261347 [details] Fixes the bug
Comment on attachment 261347 [details] Fixes the bug Attachment 261347 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.webkit.org/results/178029 Number of test failures exceeded the failure limit.
Created attachment 261353 [details] Archive of layout-test-results from ews107 for mac-mavericks-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews107 Port: mac-mavericks-wk2 Platform: Mac OS X 10.9.5
Comment on attachment 261347 [details] Fixes the bug Attachment 261347 [details] did not pass mac-ews (mac): Output: http://webkit-queues.webkit.org/results/178071 Number of test failures exceeded the failure limit.
Created attachment 261356 [details] Archive of layout-test-results from ews103 for mac-mavericks The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: ews103 Port: mac-mavericks Platform: Mac OS X 10.9.5
Okay, I don't think these failures are related to my patch.
Comment on attachment 261347 [details] Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=261347&action=review > Source/WebCore/dom/Element.cpp:1618 > + ASSERT(shadowRoot.insertedInto(*this) == InsertionDone); Oh snap, I'm not calling this function in a Release build :(
Created attachment 261364 [details] Fixed the bug
Comment on attachment 261364 [details] Fixed the bug Clearing flags on attachment: 261364 Committed r189906: <http://trac.webkit.org/changeset/189906>
All reviewed patches have been landed. Closing bug.