-
rniwa@webkit.org authored
https://bugs.webkit.org/show_bug.cgi?id=122806 Reviewed by Antti Koivisto. Source/WebCore: Merge https://chromium.googlesource.com/chromium/blink/+/858ed5f6341de9d900768c1f4668fcfce870c52e The document fragment of a template element outlives the element itself. Clear the host property on the document fragment when that happens. Test: fast/dom/HTMLTemplateElement/content-outlives-template-crash.html * dom/TemplateContentDocumentFragment.h: * html/HTMLTemplateElement.cpp: (WebCore::HTMLTemplateElement::~HTMLTemplateElement): * html/HTMLTemplateElement.h: LayoutTests: * fast/dom/HTMLTemplateElement/content-outlives-template-crash-expected.txt: Added. * fast/dom/HTMLTemplateElement/content-outlives-template-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159596 268f45cc-cd09-0410-ab3c-d52691b4dbfc
473cc62e