da014b5fc3
https://bugs.webkit.org/show_bug.cgi?id=221386 Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-02-16 Reviewed by Antti Koivisto. Source/WebCore: When details element has a display contents style, the default summary renderer is not cleared when a new summary element is added. This causes that both summary elements are rendered at the same time, instead of the active one. The crash happens when the details element is removed from the document, because the default summary element still has a valid renderer on destroy. * dom/SlotAssignment.h: (WebCore::ShadowRoot::hostChildElementDidChange): LayoutTests: * tables/table-col-indent-crash-expected.txt: Canonical link: https://commits.webkit.org/234133@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@272900 268f45cc-cd09-0410-ab3c-d52691b4dbfc |
||
|---|---|---|
| .. | ||
| hittesting | ||
| layering | ||
| mozilla | ||
| mozilla_expected_failures | ||
| colspan-with-large-value-crash-expected.txt | ||
| colspan-with-large-value-crash.html | ||
| table-col-indent-crash-expected.txt | ||
| table-col-indent-crash.html | ||
| table-section-overflow-clip-crash-expected.txt | ||
| table-section-overflow-clip-crash.html | ||