[Webkit-unassigned] [Bug 222720] REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=222720

Carlos Garcia Campos <cgarcia at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #423480|0                           |1
        is obsolete|                            |
 Attachment #425264|                            |review?
              Flags|                            |

--- Comment #44 from Carlos Garcia Campos <cgarcia at igalia.com> ---
Created attachment 425264

  --> https://bugs.webkit.org/attachment.cgi?id=425264&action=review

Patch

This is a different approach. Now nodes are removed from the assigned nodes list when they are about to be removed from the parent, ensuring we never return nullptr nodes nor nodes with nullptr parent. If we end up suing this patch maybe we can revert r266212 and use plain pointers instead of WeakPtr.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210406/5f5fef31/attachment.htm>