[Webkit-unassigned] [Bug 78878] Adding a ShadowRoot to image-backed element causes a crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=78878


MORITA Hajime <morrita at google.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Adding an IFRAME to a       |Adding a ShadowRoot to
                   |ShadowRoot causes a crash   |image-backed element causes
                   |                            |a crash




--- Comment #1 from MORITA Hajime <morrita at google.com>  2012-02-16 23:16:32 PST ---
I changed the summary line. since the reduced case unveiled that <iframe> is innocent. 
----
<script>
function boom() {
  var divWithImage = document.createElement('div');
  divWithImage.setAttribute("style", "content: url(data:text/plain,aaa);");
  document.documentElement.appendChild(divWithImage);
  var baseShadow = new WebKitShadowRoot(divWithImage); 
  baseShadow.appendChild(document.createElement('div'));
}

window.onload = boom;
</script>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.