Fix lfiespan of ScopedStyleResolver

Source/core/dom/TreeScopeAdopter.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 11 matching lines @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 #include "config.h"
 #include "core/dom/TreeScopeAdopter.h"
 
 #include "core/accessibility/AXObjectCache.h"
 #include "core/dom/Attr.h"
 #include "core/dom/NodeRareData.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/StyleEngine.h"
 #include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 
 namespace blink {
 
 void TreeScopeAdopter::moveTreeToNewScope(Node& root) const
 {
     ASSERT(needsScopeChange());
 
 #if !ENABLE(OILPAN)
@@ skipping 88 matching lines @@
 inline void TreeScopeAdopter::moveNodeToNewDocument(Node& node, Document& oldDocument, Document& newDocument) const
 {
     ASSERT(oldDocument != newDocument);
 
     if (node.hasRareData()) {
         NodeRareData* rareData = node.rareData();
         if (rareData->nodeLists())
             rareData->nodeLists()->adoptDocument(oldDocument, newDocument);
     }
 
+    ScopedStyleResolver* resolver = nullptr;
+    if (node.isShadowRoot()) {
+        resolver = node.treeScope().scopedStyleResolver();
+        // StyledScopeResolver may be null because it is lazily created.

[esprehn, 2014/11/13 19:24:06]

We probably need to clear the resolver and recompute it? Going between quirks
and non-quirks mode documents means we need to rebuild the stylesheet structures
anyway.

[kochi, 2014/11/14 05:38:39]

Looks like this only happens on special case (e.g. <marquee>)
and now investigating the cause.

Probably what you said is correct, and this fix is just hiding the
real bug.

+        if (resolver)
+            oldDocument.styleEngine()->removeScopedStyleResolver(resolver);
+    }
+
     oldDocument.moveNodeIteratorsToNewDocument(node, newDocument);
 
-    if (node.isShadowRoot())
+    if (node.isShadowRoot()) {
         toShadowRoot(node).setDocument(newDocument);
+        if (resolver)
+            newDocument.styleEngine()->addScopedStyleResolver(resolver);
+    }
 
 #if ENABLE(ASSERT)
     didMoveToNewDocumentWasCalled = false;
     oldDocumentDidMoveToNewDocumentWasCalledWith = &oldDocument;
 #endif
 
     node.didMoveToNewDocument(oldDocument);
     ASSERT(didMoveToNewDocumentWasCalled);
 }
 
 }