Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e35f75c5b988bcf1a87dcaf06ff6f4aa4905deec
https://github.com/WebKit/WebKit/commit/e35f75c5b988bcf1a87dcaf06ff6f4aa4905deec
Author: Kristian Monsen <[email protected]>
Date: 2026-10-14 (Wed, 14 Oct 2026)
Changed paths:
A
LayoutTests/fast/dom/HTMLLinkElement/link-expect-in-shadow-tree-removed-crash-expected.txt
A
LayoutTests/fast/dom/HTMLLinkElement/link-expect-in-shadow-tree-removed-crash.html
M Source/WebCore/html/HTMLLinkElement.cpp
M Source/WebCore/html/HTMLLinkElement.h
Log Message:
-----------
Crash in IdTargetObserver::~IdTargetObserver() when a <link rel=expect>
outlives its shadow root
https://bugs.webkit.org/show_bug.cgi?id=327621
rdar://189806062
Reviewed by Ryosuke Niwa.
The observer registers with the element's TreeScope, which for a link in a
shadow tree is the
ShadowRoot — and a node keeps its Document alive but not its ShadowRoot.
Destroying the observer
in removingSteps runs it while that scope is still alive, so it can no longer
outlive its registry
Test: fast/dom/HTMLLinkElement/link-expect-in-shadow-tree-removed-crash.html
*
LayoutTests/fast/dom/HTMLLinkElement/link-expect-in-shadow-tree-removed-crash-expected.txt:
Added.
*
LayoutTests/fast/dom/HTMLLinkElement/link-expect-in-shadow-tree-removed-crash.html:
Added.
* Source/WebCore/html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::processInternalResourceLink):
(WebCore::HTMLLinkElement::removingSteps):
* Source/WebCore/html/HTMLLinkElement.h:
Canonical link: https://commits.webkit.org/323795@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
