ScopedStyleResolver should be cleared when ShadowRoot is removed from document.

ScopedStyleResolver should be cleared when ShadowRoot is removed from document.

If a shadow root (=treescope), which has a style element, is moved from a document to another document, a new ShadowStyleSheetCollection is created for the shadow root.

The ShadowStyleSheetCollection has no active stylesheets, but the treescope's scopedStyleResolver has an active stylesheet.

The active stylesheet has been already cleared (i.e. clearOwnerNode is invoked) while moving.
However, StyleEngine cannot clear the treescope's resolver, because the ShadowStyleSheetCollection has no information. This causes heap-use-after-free.

BUG=443017
TEST=fast/html/marquee-clone-crash.html

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=187602

[tasak, 2014-12-18 08:44:35]

tasak@google.com changed reviewers:
+ kochi@chromium.org

[kochi, 2014-12-18 09:26:36]

Could you add more detail about what this CL intends to
in the description?

"When a ShadowRoot is removed from document, its associated
ScopedStyleResolver has to be cleared otherwise ..."?

[tasak, 2014-12-18 10:53:51]

Patchset #3 (id:40001) has been deleted

[tasak, 2014-12-18 10:56:28]

On 2014/12/18 09:26:36, Takayoshi Kochi wrote:
> Could you add more detail about what this CL intends to
> in the description?
> 
> "When a ShadowRoot is removed from document, its associated
> ScopedStyleResolver has to be cleared otherwise ..."?

Sure. Done.
And copied a layout test from https://codereview.chromium.org/808333002/.

[kochi, 2014-12-19 07:08:11]

lgtm

[tasak, 2014-12-19 13:10:58]

tasak@google.com changed reviewers:
+ haraken@chromium.org

[tasak, 2014-12-19 13:10:58]

haraken@, would you review this CL?

[haraken, 2014-12-19 13:18:00]

LGTM, based on kochi-san's LG.

[kochi, 2014-12-22 05:14:15]

The CQ bit was checked by kochi@chromium.org

[commit-bot: I haz the power, 2014-12-22 05:16:08]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/809343002/60001

[commit-bot: I haz the power, 2014-12-22 05:19:26]

Committed patchset #3 (id:60001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=187602