[webkit-reviews] review requested: [Bug 222720] REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange : [Attachment 425264] Patch

[bugzilla-daemon at webkit.org]

Carlos Garcia Campos <cgarcia at igalia.com> has asked  for review:
Bug 222720: REGRESSION(r272900): Nullptr crash in
ComposedTreeIterator::traverseNextInShadowTree() via
ShadowRoot::hostChildElementDidChange
https://bugs.webkit.org/show_bug.cgi?id=222720

Attachment 425264: Patch

https://bugs.webkit.org/attachment.cgi?id=425264&action=review




--- Comment #44 from Carlos Garcia Campos <cgarcia at igalia.com> ---
Created attachment 425264

  --> https://bugs.webkit.org/attachment.cgi?id=425264&action=review

Patch

This is a different approach. Now nodes are removed from the assigned nodes
list when they are about to be removed from the parent, ensuring we never
return nullptr nodes nor nodes with nullptr parent. If we end up suing this
patch maybe we can revert r266212 and use plain pointers instead of WeakPtr.