Crash inside moveOutOfAllShadowRoots
https://bugs.webkit.org/show_bug.cgi?id=158378
Reviewed by Antti Koivisto.
Source/WebCore:
The bug was caused by InShadowTreeFlag not being cleared when a shadow host or its ancestor was removed
due to addChildNodesToDeletionQueue not invoking notifyChildNodeRemoved when a node was in a shadow tree
but not in a document.
Fixed the bug by invoking notifyChildNodeRemoved when the removed node is either in a shadow tree
or it's in a shadow tree. Also fixed a bug in VTTCue::~VTTCue that it was trying to remove the display
tree even when the owner document was being destroyed. This results in various assertions to be hit.
Test: fast/shadow-dom/shadow-host-removal-crash.html
* dom/ContainerNodeAlgorithms.cpp:
(WebCore::addChildNodesToDeletionQueue):
* html/track/VTTCue.cpp:
(WebCore::VTTCue::~VTTCue):
LayoutTests:
Added a regression test that reproduced the crash reliably at least on my machine.
* fast/shadow-dom/shadow-host-removal-crash-expected.txt: Added.
* fast/shadow-dom/shadow-host-removal-crash.html: Added.
* platform/ios-simulator/TestExpectations:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@201736 268f45cc-cd09-0410-ab3c-d52691b4dbfc
7 files changed
