<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[208356] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/208356">208356</a></dd>
<dt>Author</dt> <dd>ryanhaddad@apple.com</dd>
<dt>Date</dt> <dd>2016-11-03 16:18:01 -0700 (Thu, 03 Nov 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/208302">r208302</a>.

This change causes LayoutTest crashes under GuardMalloc.

Reverted changeset:

&quot;Load stylesheets in link elements inside a connected shadow
tree&quot;
https://bugs.webkit.org/show_bug.cgi?id=160683
http://trac.webkit.org/changeset/208302</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomDocumentcpp">trunk/Source/WebCore/dom/Document.cpp</a></li>
<li><a href="#trunkSourceWebCoredomElementcpp">trunk/Source/WebCore/dom/Element.cpp</a></li>
<li><a href="#trunkSourceWebCoredomShadowRootcpp">trunk/Source/WebCore/dom/ShadowRoot.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementcpp">trunk/Source/WebCore/html/HTMLLinkElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementh">trunk/Source/WebCore/html/HTMLLinkElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLStyleElementcpp">trunk/Source/WebCore/html/HTMLStyleElement.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGStyleElementcpp">trunk/Source/WebCore/svg/SVGStyleElement.cpp</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastshadowdomlinkelementinshadowtreeexpectedtxt">trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastshadowdomlinkelementinshadowtreehtml">trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree.html</a></li>
<li><a href="#trunkLayoutTestsfastshadowdomresourcesgreenhostcss">trunk/LayoutTests/fast/shadow-dom/resources/green-host.css</a></li>
<li><a href="#trunkLayoutTestsfastshadowdomselectedstylesheetinshadowtreeexpectedtxt">trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastshadowdomselectedstylesheetinshadowtreehtml">trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/LayoutTests/ChangeLog        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-11-03  Ryan Haddad  &lt;ryanhaddad@apple.com&gt;
+
+        Unreviewed, rolling out r208302.
+
+        This change causes LayoutTest crashes under GuardMalloc.
+
+        Reverted changeset:
+
+        &quot;Load stylesheets in link elements inside a connected shadow
+        tree&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=160683
+        http://trac.webkit.org/changeset/208302
+
</ins><span class="cx"> 2016-11-03  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out due to crash in Amazon web site
</span></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomlinkelementinshadowtreeexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree-expected.txt (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree-expected.txt        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree-expected.txt        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-
-PASS Link elements should load stylesheets inside a connected shadow tree with closed mode 
-PASS Link elements should load stylesheets inside a connected shadow tree with open mode 
-PASS Link elements must not load stylesheets inside a disconnceted shadow tree with closed mode 
-PASS Link elements must not load stylesheets inside a disconnceted shadow tree with open mode 
-PASS Style rules loaded inside a shadow tree with closed mode must apply to a div in the shadow tree 
-PASS Style rules loaded inside a shadow tree with open mode must apply to a div in the shadow tree 
-PASS :host style rules loaded inside a shadow tree with closed mode must apply to the host element 
-PASS :host style rules loaded inside a shadow tree with open mode must apply to the host element 
-PASS Link elements should load stylesheets inside a connected shadow tree with closed mode 
-PASS Link elements should load stylesheets inside a connected shadow tree with open mode 
-
</del></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomlinkelementinshadowtreehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree.html (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree.html        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/LayoutTests/fast/shadow-dom/link-element-in-shadow-tree.html        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,143 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;title&gt;Shadow DOM: Link elements should load stylesheets inside shadow trees&lt;/title&gt;
-&lt;meta name=&quot;author&quot; title=&quot;Ryosuke Niwa&quot; href=&quot;mailto:rniwa@webkit.org&quot;&gt;
-&lt;meta name=&quot;assert&quot; content=&quot;Link elements should load inside shadow trees&quot;&gt;
-&lt;script src='../../resources/testharness.js'&gt;&lt;/script&gt;
-&lt;script src='../../resources/testharnessreport.js'&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script&gt;
-
-function wait_for_onload(element, callback = null) {
-    return new Promise(function (resolve, reject) {
-        element.onload = resolve;
-        element.onerror = reject;
-        setTimeout(() =&gt; reject('timeout'), 100);
-        if (callback)
-            return callback();
-    });
-}
-
-let test_iframe;
-function create_iframe() {
-    if (test_iframe)
-        test_iframe.remove();
-
-    test_iframe = document.createElement('iframe');
-    return wait_for_onload().then(() =&gt; test_iframe.contentWindow, () =&gt; {
-        document.body.appendChild(test_iframe);
-    }).then(function () {
-        const doc = test_iframe.contentWindow.document;
-        doc.open();
-        doc.write('&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;head&gt;&lt;body&gt;');
-        doc.close();
-        return test_iframe.contentWindow;
-    });
-}
-
-add_result_callback(() =&gt; {
-    if (test_iframe)
-        test_iframe.remove();
-});
-
-function test_stylesheet_load_in_connected_shadow_tree(mode) {
-    promise_test(() =&gt; {
-        return create_iframe().then(contentWindow =&gt; {
-            const doc = contentWindow.document;
-            const host = doc.createElement('div');
-            const link = doc.createElement('link');
-            return wait_for_onload(link, () =&gt; {
-                link.rel = 'stylesheet';
-                link.href = 'resources/green-host.css';
-                host.attachShadow({mode: mode}).appendChild(link);
-                contentWindow.document.body.appendChild(host);
-            });
-        });
-    }, `Link elements should load stylesheets inside a connected shadow tree with ${mode} mode`);
-}
-
-test_stylesheet_load_in_connected_shadow_tree('closed');
-test_stylesheet_load_in_connected_shadow_tree('open');
-
-function test_stylesheet_do_not_load_in_disconnected_shadow_tree(mode) {
-    promise_test(() =&gt; {
-        return create_iframe().then((contentWindow) =&gt; {
-            const doc = contentWindow.document;
-            const host = doc.createElement('div');
-            const link = doc.createElement('link');
-            return wait_for_onload(link, () =&gt; {
-                link.rel = 'stylesheet';
-                link.href = 'resources/green-host.css';
-                host.attachShadow({mode: mode}).appendChild(link);
-            });
-        }).then(() =&gt; {
-            assert_true(false, 'stylesheet must not load inside a disconnected shadow tree');
-        }, (error) =&gt; {
-            assert_equals(error, 'timeout');
-        });
-    }, `Link elements must not load stylesheets inside a disconnceted shadow tree with ${mode} mode`);
-}
-
-test_stylesheet_do_not_load_in_disconnected_shadow_tree('closed');
-test_stylesheet_do_not_load_in_disconnected_shadow_tree('open');
-
-function test_loaded_stylesheet_rule_in_shadow_tree_applies_to_div(mode) {
-    promise_test(() =&gt; {
-        let div;
-        return create_iframe().then(function (contentWindow) {
-            const doc = contentWindow.document;
-            const host = doc.createElement('div');
-            const shadowRoot = host.attachShadow({mode: mode});
-            shadowRoot.innerHTML = '&lt;link rel=&quot;stylesheet&quot; href=&quot;resources/green-host.css&quot;&gt;&lt;div&gt;';
-            div = shadowRoot.querySelector('div');
-            return wait_for_onload(shadowRoot.querySelector('link'), () =&gt; { doc.body.appendChild(host) });
-        }).then(() =&gt; {
-            assert_equals(getComputedStyle(div).color, 'rgb(0, 128, 0)');
-        });
-    }, `Style rules loaded inside a shadow tree with ${mode} mode must apply to a div in the shadow tree`);
-}
-
-test_loaded_stylesheet_rule_in_shadow_tree_applies_to_div('closed');
-test_loaded_stylesheet_rule_in_shadow_tree_applies_to_div('open');
-
-function test_loaded_stylesheet_rule_in_shadow_tree_applies_to_host(mode) {
-    promise_test(() =&gt; {
-        let host;
-        return create_iframe().then(function (contentWindow) {
-            const doc = contentWindow.document;
-            host = doc.createElement('div');
-            const shadowRoot = host.attachShadow({mode: mode});
-            shadowRoot.innerHTML = '&lt;link rel=&quot;stylesheet&quot; href=&quot;resources/green-host.css&quot;&gt;&lt;div&gt;';
-            return wait_for_onload(shadowRoot.querySelector('link'), () =&gt; { doc.body.appendChild(host) });
-        }).then(() =&gt; {
-            assert_equals(getComputedStyle(host).color, 'rgb(0, 128, 0)');
-        });
-    }, `:host style rules loaded inside a shadow tree with ${mode} mode must apply to the host element`);
-}
-
-test_loaded_stylesheet_rule_in_shadow_tree_applies_to_host('closed');
-test_loaded_stylesheet_rule_in_shadow_tree_applies_to_host('open');
-
-function test_title_is_ignored_in_shadow_tree(mode) {
-    promise_test(() =&gt; {
-        let doc;
-        return create_iframe().then((contentWindow) =&gt; {
-            doc = contentWindow.document;
-            const host = doc.createElement('div');
-            const shadowRoot = host.attachShadow({mode: mode});
-            shadowRoot.innerHTML = `&lt;style title=&quot;foo&quot;&gt;&lt;/style&gt;`;
-            doc.body.appendChild(host);
-        }).then(() =&gt; {
-            assert_equals(doc.selectedStylesheetSet, null);
-        });
-    }, `Link elements should load stylesheets inside a connected shadow tree with ${mode} mode`);
-}
-
-test_title_is_ignored_in_shadow_tree('closed');
-test_title_is_ignored_in_shadow_tree('open');
-
-&lt;/script&gt;
-&lt;/html&gt;
-&lt;/body&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomresourcesgreenhostcss"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/shadow-dom/resources/green-host.css (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/resources/green-host.css        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/LayoutTests/fast/shadow-dom/resources/green-host.css        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,9 +0,0 @@
</span><del>-:host, div {
-    /* For the ease of debugging. */
-    display: inline-block;
-    width: 100px;
-    height: 100px;
-
-    color: green;
-    background: green;
-}
</del></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomselectedstylesheetinshadowtreeexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree-expected.txt (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree-expected.txt        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree-expected.txt        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,8 +0,0 @@
</span><del>-
-PASS The title attribute on the style element in a document must set the preferred stylesheet. 
-PASS The title attribute on the style element inside a closed shadow tree must not set the preferred stylesheet. 
-PASS The title attribute on the style element inside an open shadow tree must not set the preferred stylesheet. 
-PASS The title attribute on the link element in a document must set the preferred stylesheet. 
-PASS The title attribute on the link element inside a closed shadow tree must not set the preferred stylesheet. 
-PASS The title attribute on the link element inside an open shadow tree must not set the preferred stylesheet. 
-
</del></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomselectedstylesheetinshadowtreehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree.html (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree.html        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/LayoutTests/fast/shadow-dom/selected-stylesheet-in-shadow-tree.html        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,99 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;title&gt;Shadow DOM: Link and style elements inside a shadow tree should not affect the preferred stylesheet&lt;/title&gt;
-&lt;meta name=&quot;author&quot; title=&quot;Ryosuke Niwa&quot; href=&quot;mailto:rniwa@webkit.org&quot;&gt;
-&lt;meta name=&quot;assert&quot; content=&quot;Link and style elements inside a shadow tree should not affect the preferred stylesheet&quot;&gt;
-&lt;script src='../../resources/testharness.js'&gt;&lt;/script&gt;
-&lt;script src='../../resources/testharnessreport.js'&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script&gt;
-
-function make_iframe(markup, testFunction) {
-    return () =&gt; {
-        const iframe = document.createElement('iframe');
-        return new Promise(function (resolve) {
-            iframe.onload = () =&gt; { resolve(iframe.contentDocument); };
-            document.body.appendChild(iframe);
-        }).then(function (doc) {
-            doc.open();
-            doc.write(markup);
-            doc.close();
-            return testFunction(doc, doc.querySelector('div'));
-        }).then(() =&gt; iframe.remove(), error =&gt; {
-            iframe.remove();
-            return Promise.reject(error);
-        });
-    };
-}
-
-// Some browsers don't synchronously update the selected stylesheet. 
-function wait_for_stylesheet_to_be_selected() {
-    return new Promise(function (resolve) {
-        setTimeout(resolve, 0);
-    });
-}
-
-promise_test(make_iframe(`&lt;!DOCTYPE html&gt;&lt;body&gt;`, (doc) =&gt; {
-    doc.body.innerHTML = `&lt;style title=&quot;foo&quot;&gt;div { color: red; }&lt;/style&gt;`;
-    return wait_for_stylesheet_to_be_selected().then(() =&gt; {
-        assert_equals(doc.preferredStylesheetSet, 'foo');
-        assert_equals(doc.selectedStylesheetSet, 'foo');
-    });
-}), 'The title attribute on the style element in a document must set the preferred stylesheet.');
-
-promise_test(make_iframe(`&lt;!DOCTYPE html&gt;&lt;body&gt;&lt;div&gt;`, (doc) =&gt; {
-    doc.querySelector('div').attachShadow({mode: 'closed'}).innerHTML = `&lt;style title=&quot;foo&quot;&gt;&lt;/style&gt;`;
-    return wait_for_stylesheet_to_be_selected().then(() =&gt; {
-        assert_equals(doc.preferredStylesheetSet, null);
-        assert_equals(doc.selectedStylesheetSet, null);
-    });
-}), 'The title attribute on the style element inside a closed shadow tree must not set the preferred stylesheet.');
-
-promise_test(make_iframe(`&lt;!DOCTYPE html&gt;&lt;body&gt;&lt;div&gt;`, (doc) =&gt; {
-    doc.querySelector('div').attachShadow({mode: 'open'}).innerHTML = `&lt;style title=&quot;foo&quot;&gt;&lt;/style&gt;`;
-    return wait_for_stylesheet_to_be_selected().then(() =&gt; {
-        assert_equals(doc.preferredStylesheetSet, null);
-        assert_equals(doc.selectedStylesheetSet, null);
-    });
-}), 'The title attribute on the style element inside an open shadow tree must not set the preferred stylesheet.');
-
-function insert_link_and_wait(parent, title) {
-    return new Promise((resolve, reject) =&gt; {
-        const link = parent.ownerDocument.createElement('link');
-        link.rel = 'stylesheet';
-        link.title = title;
-        link.href = 'resources/green-host.css';
-        link.onload = resolve;
-        parent.appendChild(link);
-        setTimeout(() =&gt; reject('Failed to load the stylesheet'), 1000);
-    }).then(() =&gt; wait_for_stylesheet_to_be_selected());
-}
-
-promise_test(make_iframe(`&lt;!DOCTYPE html&gt;&lt;body&gt;`, (doc) =&gt; {
-    return insert_link_and_wait(doc.body, 'foo').then(() =&gt; {
-        assert_equals(doc.preferredStylesheetSet, 'foo');
-        assert_equals(doc.selectedStylesheetSet, 'foo');
-    });
-}), 'The title attribute on the link element in a document must set the preferred stylesheet.');
-
-promise_test(make_iframe(`&lt;!DOCTYPE html&gt;&lt;body&gt;&lt;div&gt;`, (doc) =&gt; {
-    const root = doc.querySelector('div').attachShadow({mode: 'closed'});
-    return insert_link_and_wait(root, 'foo').then(() =&gt; {
-        assert_equals(doc.preferredStylesheetSet, null);
-        assert_equals(doc.selectedStylesheetSet, null);
-    });
-}), 'The title attribute on the link element inside a closed shadow tree must not set the preferred stylesheet.');
-
-promise_test(make_iframe(`&lt;!DOCTYPE html&gt;&lt;body&gt;&lt;div&gt;`, (doc) =&gt; {
-    const root = doc.querySelector('div').attachShadow({mode: 'open'});
-    return insert_link_and_wait(root, 'foo').then(() =&gt; {
-        assert_equals(doc.preferredStylesheetSet, null);
-        assert_equals(doc.selectedStylesheetSet, null);
-    });
-}), 'The title attribute on the link element inside an open shadow tree must not set the preferred stylesheet.');
-
-&lt;/script&gt;
-&lt;/html&gt;
-&lt;/body&gt;
</del></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/ChangeLog        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-11-03  Ryan Haddad  &lt;ryanhaddad@apple.com&gt;
+
+        Unreviewed, rolling out r208302.
+
+        This change causes LayoutTest crashes under GuardMalloc.
+
+        Reverted changeset:
+
+        &quot;Load stylesheets in link elements inside a connected shadow
+        tree&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=160683
+        http://trac.webkit.org/changeset/208302
+
</ins><span class="cx"> 2016-11-03  Chris Dumez  &lt;cdumez@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, add HTML5 specification for HTML Interactive Form Validation feature.
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.cpp (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.cpp        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/dom/Document.cpp        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -6980,13 +6980,11 @@
</span><span class="cx"> void Document::didInsertInDocumentShadowRoot(ShadowRoot&amp; shadowRoot)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(shadowRoot.inDocument());
</span><del>-    ASSERT(!m_inDocumentShadowRoots.contains(&amp;shadowRoot));
</del><span class="cx">     m_inDocumentShadowRoots.add(&amp;shadowRoot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Document::didRemoveInDocumentShadowRoot(ShadowRoot&amp; shadowRoot)
</span><span class="cx"> {
</span><del>-    ASSERT(!shadowRoot.inDocument());
</del><span class="cx">     ASSERT(m_inDocumentShadowRoots.contains(&amp;shadowRoot));
</span><span class="cx">     m_inDocumentShadowRoots.remove(&amp;shadowRoot);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Element.cpp (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Element.cpp        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/dom/Element.cpp        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -1784,6 +1784,8 @@
</span><span class="cx"> 
</span><span class="cx">     oldRoot-&gt;setHost(nullptr);
</span><span class="cx">     oldRoot-&gt;setParentTreeScope(&amp;document());
</span><ins>+
+    notifyChildNodeRemoved(*this, *oldRoot);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool canAttachAuthorShadowRoot(const Element&amp; element)
</span></span></pre></div>
<a id="trunkSourceWebCoredomShadowRootcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ShadowRoot.cpp (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ShadowRoot.cpp        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/dom/ShadowRoot.cpp        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -84,18 +84,17 @@
</span><span class="cx"> 
</span><span class="cx"> Node::InsertionNotificationRequest ShadowRoot::insertedInto(ContainerNode&amp; insertionPoint)
</span><span class="cx"> {
</span><del>-    bool wasInDocument = inDocument();
-    DocumentFragment::insertedInto(insertionPoint);
-    if (insertionPoint.inDocument() &amp;&amp; !wasInDocument)
</del><ins>+    auto result = DocumentFragment::insertedInto(insertionPoint);
+    if (inDocument())
</ins><span class="cx">         document().didInsertInDocumentShadowRoot(*this);
</span><del>-    return InsertionDone;
</del><ins>+    return result;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ShadowRoot::removedFrom(ContainerNode&amp; insertionPoint)
</span><span class="cx"> {
</span><ins>+    if (inDocument())
+        document().didRemoveInDocumentShadowRoot(*this);
</ins><span class="cx">     DocumentFragment::removedFrom(insertionPoint);
</span><del>-    if (insertionPoint.inDocument() &amp;&amp; !inDocument())
-        document().didRemoveInDocumentShadowRoot(*this);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Style::Scope&amp; ShadowRoot::styleScope()
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.cpp (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.cpp        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/html/HTMLLinkElement.cpp        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -80,6 +80,7 @@
</span><span class="cx">     , m_disabledState(Unset)
</span><span class="cx">     , m_loading(false)
</span><span class="cx">     , m_createdByParser(createdByParser)
</span><ins>+    , m_isInShadowTree(false)
</ins><span class="cx">     , m_firedLoad(false)
</span><span class="cx">     , m_loadedResource(false)
</span><span class="cx">     , m_pendingSheetType(Unknown)
</span><span class="lines">@@ -100,8 +101,8 @@
</span><span class="cx">     if (m_cachedSheet)
</span><span class="cx">         m_cachedSheet-&gt;removeClient(*this);
</span><span class="cx"> 
</span><del>-    if (m_styleScope)
-        m_styleScope-&gt;removeStyleSheetCandidateNode(*this);
</del><ins>+    if (inDocument())
+        document().styleScope().removeStyleSheetCandidateNode(*this);
</ins><span class="cx"> 
</span><span class="cx">     linkLoadEventSender().cancelEvent(*this);
</span><span class="cx">     linkErrorEventSender().cancelEvent(*this);
</span><span class="lines">@@ -111,43 +112,36 @@
</span><span class="cx"> {
</span><span class="cx">     DisabledState oldDisabledState = m_disabledState;
</span><span class="cx">     m_disabledState = disabled ? Disabled : EnabledViaScript;
</span><del>-    if (oldDisabledState == m_disabledState)
-        return;
</del><ins>+    if (oldDisabledState != m_disabledState) {
+        // If we change the disabled state while the sheet is still loading, then we have to
+        // perform three checks:
+        if (styleSheetIsLoading()) {
+            // Check #1: The sheet becomes disabled while loading.
+            if (m_disabledState == Disabled)
+                removePendingSheet();
</ins><span class="cx"> 
</span><del>-    ASSERT(inDocument() || !styleSheetIsLoading());
-    if (!inDocument())
-        return;
</del><ins>+            // Check #2: An alternate sheet becomes enabled while it is still loading.
+            if (m_relAttribute.isAlternate &amp;&amp; m_disabledState == EnabledViaScript)
+                addPendingSheet(ActiveSheet);
</ins><span class="cx"> 
</span><del>-    // If we change the disabled state while the sheet is still loading, then we have to
-    // perform three checks:
-    if (styleSheetIsLoading()) {
-        // Check #1: The sheet becomes disabled while loading.
-        if (m_disabledState == Disabled)
-            removePendingSheet();
</del><ins>+            // Check #3: A main sheet becomes enabled while it was still loading and
+            // after it was disabled via script. It takes really terrible code to make this
+            // happen (a double toggle for no reason essentially). This happens on
+            // virtualplastic.net, which manages to do about 12 enable/disables on only 3
+            // sheets. :)
+            if (!m_relAttribute.isAlternate &amp;&amp; m_disabledState == EnabledViaScript &amp;&amp; oldDisabledState == Disabled)
+                addPendingSheet(ActiveSheet);
</ins><span class="cx"> 
</span><del>-        // Check #2: An alternate sheet becomes enabled while it is still loading.
-        if (m_relAttribute.isAlternate &amp;&amp; m_disabledState == EnabledViaScript)
-            addPendingSheet(ActiveSheet);
</del><ins>+            // If the sheet is already loading just bail.
+            return;
+        }
</ins><span class="cx"> 
</span><del>-        // Check #3: A main sheet becomes enabled while it was still loading and
-        // after it was disabled via script. It takes really terrible code to make this
-        // happen (a double toggle for no reason essentially). This happens on
-        // virtualplastic.net, which manages to do about 12 enable/disables on only 3
-        // sheets. :)
-        if (!m_relAttribute.isAlternate &amp;&amp; m_disabledState == EnabledViaScript &amp;&amp; oldDisabledState == Disabled)
-            addPendingSheet(ActiveSheet);
-
-        // If the sheet is already loading just bail.
-        return;
</del><ins>+        // Load the sheet, since it's never been loaded before.
+        if (!m_sheet &amp;&amp; m_disabledState == EnabledViaScript)
+            process();
+        else
+            document().styleScope().didChangeActiveStyleSheetCandidates();
</ins><span class="cx">     }
</span><del>-
-    // Load the sheet, since it's never been loaded before.
-    if (!m_sheet &amp;&amp; m_disabledState == EnabledViaScript)
-        process();
-    else {
-        ASSERT(m_styleScope);
-        m_styleScope-&gt;didChangeActiveStyleSheetCandidates();
-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLLinkElement::parseAttribute(const QualifiedName&amp; name, const AtomicString&amp; value)
</span><span class="lines">@@ -182,7 +176,7 @@
</span><span class="cx">         m_media = value.string().convertToASCIILowercase();
</span><span class="cx">         process();
</span><span class="cx">         if (m_sheet &amp;&amp; !isDisabled())
</span><del>-            m_styleScope-&gt;didChangeActiveStyleSheetCandidates();
</del><ins>+            document().styleScope().didChangeActiveStyleSheetCandidates();
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (name == disabledAttr) {
</span><span class="lines">@@ -220,7 +214,7 @@
</span><span class="cx"> 
</span><span class="cx"> void HTMLLinkElement::process()
</span><span class="cx"> {
</span><del>-    if (!inDocument()) {
</del><ins>+    if (!inDocument() || m_isInShadowTree) {
</ins><span class="cx">         ASSERT(!m_sheet);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -289,7 +283,7 @@
</span><span class="cx">     } else if (m_sheet) {
</span><span class="cx">         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
</span><span class="cx">         clearSheet();
</span><del>-        m_styleScope-&gt;didChangeActiveStyleSheetCandidates();
</del><ins>+        document().styleScope().didChangeActiveStyleSheetCandidates();
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -303,14 +297,16 @@
</span><span class="cx"> 
</span><span class="cx"> Node::InsertionNotificationRequest HTMLLinkElement::insertedInto(ContainerNode&amp; insertionPoint)
</span><span class="cx"> {
</span><del>-    bool wasInDocument = inDocument();
</del><span class="cx">     HTMLElement::insertedInto(insertionPoint);
</span><del>-    if (!insertionPoint.inDocument() || wasInDocument)
</del><ins>+    if (!insertionPoint.inDocument())
</ins><span class="cx">         return InsertionDone;
</span><span class="cx"> 
</span><del>-    m_styleScope = &amp;Style::Scope::forNode(*this);
-    m_styleScope-&gt;addStyleSheetCandidateNode(*this, m_createdByParser);
</del><ins>+    m_isInShadowTree = isInShadowTree();
+    if (m_isInShadowTree)
+        return InsertionDone;
</ins><span class="cx"> 
</span><ins>+    document().styleScope().addStyleSheetCandidateNode(*this, m_createdByParser);
+
</ins><span class="cx">     process();
</span><span class="cx">     return InsertionDone;
</span><span class="cx"> }
</span><span class="lines">@@ -318,20 +314,20 @@
</span><span class="cx"> void HTMLLinkElement::removedFrom(ContainerNode&amp; insertionPoint)
</span><span class="cx"> {
</span><span class="cx">     HTMLElement::removedFrom(insertionPoint);
</span><del>-    if (!insertionPoint.inDocument() || inDocument())
</del><ins>+    if (!insertionPoint.inDocument())
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><ins>+    if (m_isInShadowTree) {
+        ASSERT(!m_sheet);
+        return;
+    }
+    document().styleScope().removeStyleSheetCandidateNode(*this);
+
</ins><span class="cx">     if (m_sheet)
</span><span class="cx">         clearSheet();
</span><span class="cx"> 
</span><span class="cx">     if (styleSheetIsLoading())
</span><span class="cx">         removePendingSheet(RemovePendingSheetNotifyLater);
</span><del>-    
-    if (m_styleScope) {
-        m_styleScope-&gt;removeStyleSheetCandidateNode(*this);
-        m_styleScope = nullptr;
-    }
-
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLLinkElement::finishParsingChildren()
</span><span class="lines">@@ -548,8 +544,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (m_pendingSheetType == InactiveSheet)
</span><span class="cx">         return;
</span><del>-    ASSERT(m_styleScope);
-    m_styleScope-&gt;addPendingSheet();
</del><ins>+    document().styleScope().addPendingSheet();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLLinkElement::removePendingSheet(RemovePendingSheetNotificationType notification)
</span><span class="lines">@@ -560,14 +555,13 @@
</span><span class="cx">     if (type == Unknown)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    ASSERT(m_styleScope);
</del><span class="cx">     if (type == InactiveSheet) {
</span><span class="cx">         // Document just needs to know about the sheet for exposure through document.styleSheets
</span><del>-        m_styleScope-&gt;didChangeActiveStyleSheetCandidates();
</del><ins>+        document().styleScope().didChangeActiveStyleSheetCandidates();
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_styleScope-&gt;removePendingSheet(
</del><ins>+    document().styleScope().removePendingSheet(
</ins><span class="cx">         notification == RemovePendingSheetNotifyImmediately
</span><span class="cx">         ? Style::Scope::RemovePendingSheetNotifyImmediately
</span><span class="cx">         : Style::Scope::RemovePendingSheetNotifyLater);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.h (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.h        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/html/HTMLLinkElement.h        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -119,7 +119,6 @@
</span><span class="cx">     void removePendingSheet(RemovePendingSheetNotificationType = RemovePendingSheetNotifyImmediately);
</span><span class="cx"> 
</span><span class="cx">     LinkLoader m_linkLoader;
</span><del>-    Style::Scope* m_styleScope { nullptr };
</del><span class="cx">     CachedResourceHandle&lt;CachedCSSStyleSheet&gt; m_cachedSheet;
</span><span class="cx">     RefPtr&lt;CSSStyleSheet&gt; m_sheet;
</span><span class="cx">     enum DisabledState {
</span><span class="lines">@@ -135,6 +134,7 @@
</span><span class="cx">     LinkRelAttribute m_relAttribute;
</span><span class="cx">     bool m_loading;
</span><span class="cx">     bool m_createdByParser;
</span><ins>+    bool m_isInShadowTree;
</ins><span class="cx">     bool m_firedLoad;
</span><span class="cx">     bool m_loadedResource;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLStyleElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLStyleElement.cpp (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLStyleElement.cpp        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/html/HTMLStyleElement.cpp        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -94,17 +94,18 @@
</span><span class="cx"> 
</span><span class="cx"> Node::InsertionNotificationRequest HTMLStyleElement::insertedInto(ContainerNode&amp; insertionPoint)
</span><span class="cx"> {
</span><del>-    bool wasInDocument = inDocument();
-    auto result = HTMLElement::insertedInto(insertionPoint);
-    if (insertionPoint.inDocument() &amp;&amp; !wasInDocument)
</del><ins>+    HTMLElement::insertedInto(insertionPoint);
+    if (insertionPoint.inDocument())
</ins><span class="cx">         m_styleSheetOwner.insertedIntoDocument(*this);
</span><del>-    return result;
</del><ins>+
+    return InsertionDone;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLStyleElement::removedFrom(ContainerNode&amp; insertionPoint)
</span><span class="cx"> {
</span><span class="cx">     HTMLElement::removedFrom(insertionPoint);
</span><del>-    if (insertionPoint.inDocument() &amp;&amp; !inDocument())
</del><ins>+
+    if (insertionPoint.inDocument())
</ins><span class="cx">         m_styleSheetOwner.removedFromDocument(*this);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGStyleElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGStyleElement.cpp (208355 => 208356)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGStyleElement.cpp        2016-11-03 23:10:53 UTC (rev 208355)
+++ trunk/Source/WebCore/svg/SVGStyleElement.cpp        2016-11-03 23:18:01 UTC (rev 208356)
</span><span class="lines">@@ -116,17 +116,16 @@
</span><span class="cx"> 
</span><span class="cx"> Node::InsertionNotificationRequest SVGStyleElement::insertedInto(ContainerNode&amp; rootParent)
</span><span class="cx"> {
</span><del>-    bool wasInDocument = inDocument();
-    auto result = SVGElement::insertedInto(rootParent);
-    if (rootParent.inDocument() &amp;&amp; !wasInDocument)
</del><ins>+    SVGElement::insertedInto(rootParent);
+    if (rootParent.inDocument())
</ins><span class="cx">         m_styleSheetOwner.insertedIntoDocument(*this);
</span><del>-    return result;
</del><ins>+    return InsertionDone;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void SVGStyleElement::removedFrom(ContainerNode&amp; rootParent)
</span><span class="cx"> {
</span><span class="cx">     SVGElement::removedFrom(rootParent);
</span><del>-    if (rootParent.inDocument() &amp;&amp; !inDocument())
</del><ins>+    if (rootParent.inDocument())
</ins><span class="cx">         m_styleSheetOwner.removedFromDocument(*this);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>