The following is stack trace: ASSERTION FAILED: !attached() third_party/WebKit/Source/WebCore/dom/Node.cpp(1312) : virtual void WebCore::Node::attach() 1 0x75f580 2 0x7b8e3a 3 0x6cc6cd 4 0x6ca3a6 5 0x735b9f 6 0x10aa4a9 7 0x6cc6cd 8 0x6ca3a6 9 0x735b9f 10 0x6cbdcd 11 0x6c9e4d 12 0x152d71c 13 0x7adbe3 14 0x1c43873 15 0xca5fb9 16 0xca9b53 17 0xca8054 18 0xca5cbe 19 0xee172c 20 0xee4450 21 0x24ed9850618e [20163:20163:1570975979892:ERROR:process_util_posix.cc(143)] Received signal 11 base::debug::StackTrace::StackTrace() [0x87993e] base::(anonymous namespace)::StackDumpSignalHandler() [0x839a01] 0x7f306becbaf0 WebCore::Node::attach() [0x75f58a] WebCore::Text::attach() [0x7b8e3a] WebCore::ContainerNode::attachChildren() [0x6cc6cd] WebCore::ContainerNode::attach() [0x6ca3a6] WebCore::Element::attach() [0x735b9f] WebCore::InsertionPoint::attach() [0x10aa4a9] WebCore::ContainerNode::attachChildren() [0x6cc6cd] WebCore::ContainerNode::attach() [0x6ca3a6] WebCore::Element::attach() [0x735b9f] WebCore::updateTreeAfterInsertion() [0x6cbdcd] WebCore::ContainerNode::appendChild() [0x6c9e4d] WebCore::replaceChildrenWithFragment() [0x152d71c] WebCore::ShadowRoot::setInnerHTML() [0x7adbe3] WebCore::ShadowRootV8Internal::innerHTMLAttrSetter() [0x1c43873] v8::internal::JSObject::SetPropertyWithCallback() [0xca5fb9] v8::internal::JSObject::SetPropertyForResult() [0xca9b53] v8::internal::JSReceiver::SetProperty() [0xca8054] v8::internal::JSReceiver::SetProperty() [0xca5cbe] v8::internal::StoreIC::Store() [0xee172c] v8::internal::StoreIC_Miss() [0xee4450] 0x24ed9850618e
Created attachment 145960 [details] repro
Created attachment 146199 [details] Patch
Dimitri, could you take a look? takak@ caught this slip-out from the last refactoring.
s/takak@/tasak@/
Comment on attachment 146199 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=146199&action=review > Source/WebCore/ChangeLog:3 > + A style in an older shadow subtree causes assert when composing with <shadow/> Really minor nit: don't use XML self-closing tag syntax. We're not in XML-land :)
(In reply to comment #5) > > Really minor nit: don't use XML self-closing tag syntax. We're not in XML-land :) I admit that a part of my mind has been sticking at that era :-) Will fix.
Created attachment 146445 [details] Patch for landing
Comment on attachment 146445 [details] Patch for landing Clearing flags on attachment: 146445 Committed r119790: <http://trac.webkit.org/changeset/119790>
All reviewed patches have been landed. Closing bug.