• antti@apple.com's avatar
    <https://webkit.org/b/119969> REGRESSION (r154232): Crash on the japantimes.co.jp · 3cf260a2
    antti@apple.com authored
    Source/WebCore: 
    
    Reviewed by Andreas Kling.
            
    PseudoElement no longer has parent and calling Element::insertedInto for them crashes as it tries to access it.
    
    Normally there are no pseudo elements when Element::insertedInto() is invoked as they get detached and attached
    along with rendering. However in this case the page inserts a <style> that uses ::before along with an element
    that it applies to. Stylesheet insertion triggers synchronous style recalc that attaches rendering to all newly
    insered elements. Later Element::insertedInto gets called for the element that has pseudo element and we crash.
    
    Test: fast/css-generated-content/insert-stylesheet-and-pseudo-crash.html
    
    * dom/Element.cpp:
    (WebCore::Element::insertedInto):
    (WebCore::Element::removedFrom):
            
        Remove calls to insertedInto/removedFrom for pseudo elements. They are not considered to be in document.
        When they are added normally during rende...
    3cf260a2