Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
REGRESSION(r190430): Assertion failure in Text::~Text()
https://bugs.webkit.org/show_bug.cgi?id=153577 Reviewed by Antti Koivisto. Source/WebCore: The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object. Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement. Test: fast/shadow-dom/slot-removal-crash-2.html * dom/ContainerNode.cpp: (WebCore::destroyRenderTreeIfNeeded): LayoutTests: Added a regression test. The test hits an assertion in debug build without the fix. * fast/shadow-dom/slot-removal-crash-2-expected.txt: Added. * fast/shadow-dom/slot-removal-crash-2.html: Added. Canonical link: https://commits.webkit.org/171653@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@195727 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information
Showing with 84 additions and 1 deletion.