REGRESSION(r190430): Assertion failure in Text::~Text()
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jan 2016 04:42:36 +0000 (04:42 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jan 2016 04:42:36 +0000 (04:42 +0000)
commit6b59c20ca180b29edc7723485ca2cc8269683972
treec56aab03fa5a77c82952758b399e0ca88e56d957
parente7050d05b25c4bb9899b30252e205979bbbf2155
REGRESSION(r190430): Assertion failure in Text::~Text()
https://bugs.webkit.org/show_bug.cgi?id=153577

Reviewed by Antti Koivisto.

Source/WebCore:

The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.

Test: fast/shadow-dom/slot-removal-crash-2.html

* dom/ContainerNode.cpp:
(WebCore::destroyRenderTreeIfNeeded):

LayoutTests:

Added a regression test. The test hits an assertion in debug build without the fix.

* fast/shadow-dom/slot-removal-crash-2-expected.txt: Added.
* fast/shadow-dom/slot-removal-crash-2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@195727 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/shadow-dom/slot-removal-crash-2-expected.txt [new file with mode: 0644]
LayoutTests/fast/shadow-dom/slot-removal-crash-2.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/ContainerNode.cpp