LibWeb: Use correct scope when removing style sheet inside a shadow tree

Before this change, removing a style element from inside a shadow tree
would cause it to be unregistered with the document-level list of sheets
instead of the shadow-root-level list.

This would eventually lead to a verification failure if someone tried to
update the text contents of that style element, since it was still in
the shadow-root-level list, but now with a null owner element.

Fixes a crash on https://www.swedbank.se/
This commit is contained in:
Andreas Kling 2024-07-23 09:53:32 +02:00 committed by Andreas Kling
commit 3b7534b362
Notes: github-actions[bot] 2024-07-23 09:13:10 +00:00
6 changed files with 45 additions and 5 deletions

View file

@ -0,0 +1,20 @@
<div id=foo>
<template shadowrootmode="open">
<style>
div { border: 5px solid black; }
</style>
<div>hello</div>
</template>
</div>
<script src="../include.js"></script>
<script>
test(() => {
println(foo.shadowRoot.styleSheets);
println("Before remove, sheet count: " + foo.shadowRoot.styleSheets.length);
let style = foo.shadowRoot.firstElementChild;
style.remove()
println("After remove, sheet count: " + foo.shadowRoot.styleSheets.length);
style.innerText = "div { border: 10px solid red; }";
println("After setting innerText of removed sheet, we're still alive!");
});
</script>