[Webkit-unassigned] [Bug 66241] Crash when inserting text with a trailing newline into a textarea via JS

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=66241





--- Comment #7 from Kent Tamura <tkent at chromium.org>  2011-08-24 21:20:23 PST ---
(In reply to comment #6)
> (In reply to comment #5)
> > Why is the textNode detached by m_frame->document()->updateLayout()?
> 
> It's causing the shadow DOM tree to be re-created.  The text node is in the shadow tree.

Do you mean HTMLTextElement::innerTextElement() is re-created? HTMLTextAreaElement and RenderTextControl* doesn't recreate it, so the editing code does it?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.