-
morrita@google.com authored
https://bugs.webkit.org/show_bug.cgi?id=88299 Reviewed by Dimitri Glazkov. Source/WebCore: InsertionPoint::attach() assumes its distributed content not being attach()-ed. But this assumption can break. This change added a guard for that. This can happen for shadow boundaries in general. But ShadowRoot already handles that case. Test: fast/dom/shadow/insertion-point-shadow-crash.html * html/shadow/InsertionPoint.cpp: (WebCore::InsertionPoint::attach): LayoutTests: * fast/dom/shadow/insertion-point-shadow-crash-expected.txt: Added. * fast/dom/shadow/insertion-point-shadow-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119790 268f45cc-cd09-0410-ab3c-d52691b4dbfc
73719372