[Webkit-unassigned] [Bug 100455] New: [Shadow]: removing styles in shadow dom subtree causes crash.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=100455

           Summary: [Shadow]: removing styles in shadow dom subtree causes
                    crash.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: tasak at google.com
        Depends on: 88606


Created an attachment (id=170806)
 --> (https://bugs.webkit.org/attachment.cgi?id=170806&action=review)
repro.html

The bug 100246, https://bugs.webkit.org/show_bug.cgi?id=100246, has already reported this as "The new test fast/dom/shadow/athost-atrules.html is crashing on our debug bot".

If shadow root has more than two styles and the styles are not direct children of the shadow root, removing the styles causes crashing. For example,

<#shadow-root>
   <div>
       <style>span { color: red; }</style>
       <span>Hello</span>
   </div>
   <div>
       <style>.world { color: blue; } </style>
        <span class="world">World</span>
   </div>
</#shadow-root>

So when removing <style>s (e.g. do shadowroot.innerHTML="" or something), chrome/DumpRenderTree crashes.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.