Assertion failure when mouse points to a direct child text node of shadow root

[Hayato Ito]

Let me quote the test case from https://bugs.webkit.org/show_bug.cgi?id=86795#c3.

<div id="container"></div>
<script>
var shadowRoot = new WebKitShadowRoot(document.getElementById('container'));
shadowRoot.innerHTML = 'a';
</script>


Moving the cursor over the 'a' results in the following assert:
ASSERTION FAILED: !m_node->isShadowRoot()
../../third_party/WebKit/Source/WebCore/dom/ComposedShadowTreeWalker.h(81) : void WebCore::ComposedShadowTreeWalker::assertPrecondition() const

[Hayato Ito]

Created attachment 143186 [details]
remove an assertion

[Dimitri Glazkov (Google)]

Comment on attachment 143186 [details]
remove an assertion

View in context: https://bugs.webkit.org/attachment.cgi?id=143186&action=review

> Source/WebCore/dom/ComposedShadowTreeWalker.cpp:57
> +    // assertPrecondition();

We usually don't land commented code like this. Perhaps your FIXME description could mention it.

[Hayato Ito]

Thank you for the review.

(In reply to comment #2)
> (From update of attachment 143186 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=143186&action=review
> 
> > Source/WebCore/dom/ComposedShadowTreeWalker.cpp:57
> > +    // assertPrecondition();
> 
> We usually don't land commented code like this. Perhaps your FIXME description could mention it.

Okay. I'll mention that in FIXME. Let me land this after that, merging with ToT.

[Hayato Ito]

Created attachment 143458 [details]
Patch for landing

[WebKit Review Bot]

Comment on attachment 143458 [details]
Patch for landing

Clearing flags on attachment: 143458

Committed r118125: <http://trac.webkit.org/changeset/118125>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.