-
morrita@google.com authored
https://bugs.webkit.org/show_bug.cgi?id=91055 Reviewed by Kent Tamura. Source/WebCore: This is similar to Bug 90480, where an undesired renderer is created by locating an insertion point on the shadow boundary. This change adds a guard for such case by cheking whether the source node of each to-be-created renderer comes from the UA shadow tree, which is allowed to have a renderer. Test: fast/dom/shadow/insertion-point-video-crash.html * html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::childShouldCreateRenderer): Added a check. (WebCore::HTMLMediaElement::mediaControls): Added const. (WebCore::HTMLMediaElement::hasMediaControls): Added const. * html/HTMLMediaElement.h: (HTMLMediaElement): LayoutTests: * fast/dom/shadow/insertion-point-video-crash-expected.txt: Added. * fast/dom/shadow/insertion-point-video-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122432 268f45cc-cd09-0410-ab3c-d52691b4dbfc
82884d07