[webkit-reviews] review denied: [Bug 25567] Crash when writing into a detached TITLE element : [Attachment 52002] v0; add a guard for orphan node

[bugzilla-daemon at webkit.org]

Alexey Proskuryakov <ap at webkit.org> has denied MORITA Hajime
<morrita at google.com>'s request for review:
Bug 25567: Crash when writing into a detached TITLE element
https://bugs.webkit.org/show_bug.cgi?id=25567

Attachment 52002: v0; add a guard for orphan node
https://bugs.webkit.org/attachment.cgi?id=52002&action=review

------- Additional Comments from Alexey Proskuryakov <ap at webkit.org>
Marking r- to get this out of review queue. Depending on investigation results,
we may or may not end up making this exact change, but the test needs some
rewording.

+    // Newly created nodes can be removed immediately inside
+    // Node::childrenChanged() inside Node::addChild() due to DOM
+    // normalization process like concatinating <title> text contents.
+    // We should skip processing such nodes because their contents already
merged into the tree. 

Typo: should be "concatenation". I wonder if there are any other cases where
this could happen, besides setting document.title. Ideally, we'd need as many
test cases for different scenarios as possible.