Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 10 May 2018 00:08:40 +0000 (00:08 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 10 May 2018 00:08:40 +0000 (00:08 +0000)
commitdfb85a7cfca31c33829e993b23c6ff0ea33abc8f
tree46df7a324eb5118f2e258b2c25e063c8b87cf877
parentc9195b066637717b1c1e03adc83553c3bd906896
Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
https://bugs.webkit.org/show_bug.cgi?id=185493

Reviewed by Brent Fulgham.

Source/WebCore:

Fixed the bug that HTMLImageElement::removedFromAncestor and HTMLMapElement::removedFromAncestor
were calling removeImageElementByUsemap on the document instead of the shadow tree from which it was removed.

Test: fast/images/imagemap-in-shadow-tree-removed.html

* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::removedFromAncestor):
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::removedFromAncestor):

LayoutTests:

Added a regression test.

* fast/images/imagemap-in-shadow-tree-removed-expected.txt: Added.
* fast/images/imagemap-in-shadow-tree-removed.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@231621 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt [new file with mode: 0644]
LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/HTMLImageElement.cpp
Source/WebCore/html/HTMLMapElement.cpp