HTMLSlotElement::insertedInto and HTMLSlotElement::removedFrom are completely wrong.
Created attachment 261561 [details] Fixes the bug
Comment on attachment 261561 [details] Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=261561&action=review > Source/WebCore/html/HTMLSlotElement.cpp:52 > + if (insertionPoint.isInShadowTree() && isInShadowTree() && &insertionPoint.treeScope() == &treeScope()) { This could use a comment. > Source/WebCore/html/HTMLSlotElement.cpp:53 > + if (auto shadowRoot = containingShadowRoot()) auto* > Source/WebCore/html/HTMLSlotElement.cpp:63 > // Can't call containingShadowRoot() here since this node has already been disconnected from the parent. > - if (isInShadowTree()) { > - auto& oldShadowRoot = downcast<ShadowRoot>(insertionPoint.treeScope().rootNode()); > - oldShadowRoot.removeSlotElementByName(fastGetAttribute(nameAttr), *this); > + if (insertionPoint.isInShadowTree() && isInShadowTree() && &treeScope() == &document()) { This could use a bit more comprehensive comment.
Created attachment 261563 [details] Patch for landing
Comment on attachment 261563 [details] Patch for landing Rejecting attachment 261563 [details] from commit-queue. Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-02', 'validate-changelog', '--check-oops', '--non-interactive', 261563, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit ChangeLog entry in LayoutTests/ChangeLog contains OOPS!. Full output: http://webkit-queues.webkit.org/results/185244
Created attachment 261564 [details] Patch for landing
Comment on attachment 261564 [details] Patch for landing Clearing flags on attachment: 261564 Committed r190008: <http://trac.webkit.org/changeset/190008>
All reviewed patches have been landed. Closing bug.