Cherry-pick 273885@main (de15933). https://bugs.webkit.org/show_bug.c…

…gi?id=268434

    CrashTracer: com.apple.WebKit.WebContent at WebCore: WebCore::Document::addTopLayerElement
    https://bugs.webkit.org/show_bug.cgi?id=268434
    rdar://117975912

    Reviewed by Chris Dumez.

    The release assertion here is bogus, the top layer is a DOM construct that is used for various DOM algorithms, not just a rendering one.

    Things in the top layer are not required to be rendered.

    * LayoutTests/fullscreen/fullscreen-add-disconnected-to-top-layer-expected.txt: Added.
    * LayoutTests/fullscreen/fullscreen-add-disconnected-to-top-layer.html: Added.
    * Source/WebCore/dom/Document.cpp:
    (WebCore::Document::addTopLayerElement):

    Canonical link: https://commits.webkit.org/273885@main

Canonical link: https://commits.webkit.org/266719.361@webkitglib/2.42

LayoutTests/fullscreen/fullscreen-add-disconnected-to-top-layer-expected.txt

@@ -0,0 +1,5 @@
+Click to run test manually
+Test passes if there is no crash
+
+END OF TEST
+

LayoutTests/fullscreen/fullscreen-add-disconnected-to-top-layer.html

@@ -0,0 +1,18 @@
+<button id="button">Click to run test manually</button>
+<p>Test passes if there is no crash</p>
+<div id="target">To be fullscreened</div>
+<script src="full-screen-test.js"></script>
+<script>
+    function test() {
+        target.requestFullscreen();
+        requestAnimationFrame(() => {
+            target.remove();
+            endTest();
+        });
+    }
+    button.onclick = test;
+    onload = () => {
+        if (window.internals)
+            runWithKeyDown(test);
+    }
+</script>

Source/WebCore/dom/Document.cpp

@@ -8831,7 +8831,7 @@ void Document::keyframesRuleDidChange(const String& name)
 
 void Document::addTopLayerElement(Element& element)
 {
-    RELEASE_ASSERT(&element.document() == this && element.isConnected() && !element.isInTopLayer());
+    RELEASE_ASSERT(&element.document() == this && !element.isInTopLayer());
     auto result = m_topLayerElements.add(element);
     RELEASE_ASSERT(result.isNewEntry);
     if (auto* candidatePopover = dynamicDowncast<HTMLElement>(element); candidatePopover && candidatePopover->popoverState() == PopoverState::Auto) {