mirror of
https://github.com/LadybirdBrowser/ladybird
synced 2026-04-25 17:25:08 +02:00
3cf24872c4
HTMLLinkElement::removed_from() used `old_root` to find the StyleSheetList to remove the link's stylesheet from. That's wrong when the link element lives inside a shadow tree that is itself nested within a larger removed subtree: Node::remove() hands every shadow-including descendant the outer subtree's root as `old_root`, not the descendant's own containing root. So we'd look in the document's list while the sheet was actually in the shadow root's list, failing the did_remove VERIFY in StyleSheetList::remove_sheet. Fix by using the sheet's own owning-root tracking. A link-owned sheet always has exactly one owning document or shadow root (only constructed stylesheets can be adopted, and link sheets are never constructed), so we can just read that entry. Also make owning_documents_or_shadow_roots() return by const reference instead of copying the HashTable on every call, which benefits existing iterating callers too. Fixes a crash on https://nytimes.com/.