[Webkit-unassigned] [Bug 222720] REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=222720

--- Comment #36 from Antti Koivisto <koivisto at iki.fi> ---
Isn't it the same exact issue with the only difference being whether anyone is holding the removed nodes alive or not? If nothing keeps them alive you get the nullptr crash, if someone does you'll see a parentless element.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210318/904737dc/attachment-0001.htm>