[Shadow DOM] <video> with <shadow> crashes

[Hajime Morrita]

This is upstream of http://code.google.com/p/chromium/issues/detail?id=136952

[Hajime Morrita]

Created attachment 151878 [details]
Patch

[Hajime Morrita]

Kent-san, could you take a look?

[Kent Tamura]

Comment on attachment 151878 [details]
Patch

Looks ok.

[WebKit Review Bot]

Comment on attachment 151878 [details]
Patch

Clearing flags on attachment: 151878

Committed r122432: <http://trac.webkit.org/changeset/122432>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Eric Carlson]

Comment on attachment 151878 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=151878&action=review

> Source/WebCore/ChangeLog:11
> +        This change adds a guard for such case by cheking whether the

Typo: "cheking" should be "checking".

> Source/WebCore/html/HTMLMediaElement.cpp:495
> +    // Only allows nodes from the controls shadow subtree.
> +    return (mediaControls()->treeScope() == childContext.node()->treeScope()
> +            && childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext));

"Only allows nodes from the controls shadow subtree" tells me what the code does but now why. 

Why are non-shadow child nodes not allowed to create a renderer?

[Hajime Morrita]

(In reply to comment #6)
> (From update of attachment 151878 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=151878&action=review
> 
> > Source/WebCore/ChangeLog:11
> > +        This change adds a guard for such case by cheking whether the
> 
> Typo: "cheking" should be "checking".
> 
> > Source/WebCore/html/HTMLMediaElement.cpp:495
> > +    // Only allows nodes from the controls shadow subtree.
> > +    return (mediaControls()->treeScope() == childContext.node()->treeScope()
> > +            && childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext));
> 
> "Only allows nodes from the controls shadow subtree" tells me what the code does but now why. 
> 
> Why are non-shadow child nodes not allowed to create a renderer?

Good point. I'll (In reply to comment #6)
> (From update of attachment 151878 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=151878&action=review
> 
> > Source/WebCore/ChangeLog:11
> > +        This change adds a guard for such case by cheking whether the
> 
> Typo: "cheking" should be "checking".
> 
> > Source/WebCore/html/HTMLMediaElement.cpp:495
> > +    // Only allows nodes from the controls shadow subtree.
> > +    return (mediaControls()->treeScope() == childContext.node()->treeScope()
> > +            && childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext));
> 
> "Only allows nodes from the controls shadow subtree" tells me what the code does but now why. 
> 
> Why are non-shadow child nodes not allowed to create a renderer?
Good point. I'll clarify it on Bug 91174.