Split out from issue 847570 .
When calling 'script.append('fail', style)', we seem to be evaluating 'fail' as a script synchronously before HTMLStyleElement::DidNotifySubtreeInsertionsToDocument happens. The onerror then modifies the HTMLStyleElement, which is in a weird state, because the previous ContainerNode::AppendChild has still not completed.
Related: https://chromiumcodereview.appspot.com/16425002
REPRO:
<script>
function start() {
style = document.createElement('style');
document.body.appendChild(style);
let sr = shadowHost.createShadowRoot();
let script = document.createElement('script');
sr.appendChild(script);
script.append('fail', style);
}
window.onerror = function() {
style.appendChild(document.createTextNode(''));
}
</script>
<div id="shadowHost">
</div>
<body onload="start()"></body>
Comment 1 by bugdroid1@chromium.org
, Jun 19 2018