Title: [255448] trunk
- Revision
- 255448
- Author
- [email protected]
- Date
- 2020-01-30 12:59:52 -0800 (Thu, 30 Jan 2020)
Log Message
Crash in RenderElement::selectionPseudoStyle with detail element set to display: contents
https://bugs.webkit.org/show_bug.cgi?id=206705
Patch by Doug Kelly <[email protected]> on 2020-01-30
Reviewed by Zalan Bujtas.
Source/WebCore:
Check the element for a valid renderer before calling getUncachedPseudoStyle(), and if the
element is set to "display: contents", walk up to the parent element until we're at the root
or the element is not set to "display: contents".
Test: fast/css/display-contents-detail-selection.html
* rendering/RenderElement.cpp:
(WebCore::RenderElement::selectionPseudoStyle const):
LayoutTests:
* fast/css/display-contents-detail-selection-expected.txt: Added.
* fast/css/display-contents-detail-selection.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (255447 => 255448)
--- trunk/LayoutTests/ChangeLog 2020-01-30 20:02:19 UTC (rev 255447)
+++ trunk/LayoutTests/ChangeLog 2020-01-30 20:59:52 UTC (rev 255448)
@@ -1,3 +1,13 @@
+2020-01-30 Doug Kelly <[email protected]>
+
+ Crash in RenderElement::selectionPseudoStyle with detail element set to display: contents
+ https://bugs.webkit.org/show_bug.cgi?id=206705
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/css/display-contents-detail-selection-expected.txt: Added.
+ * fast/css/display-contents-detail-selection.html: Added.
+
2020-01-30 Truitt Savell <[email protected]>
[ Mac ] fast/history/page-cache-webdatabase-pending-transaction.html is timing out
Added: trunk/LayoutTests/fast/css/display-contents-detail-selection-expected.txt (0 => 255448)
--- trunk/LayoutTests/fast/css/display-contents-detail-selection-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/display-contents-detail-selection-expected.txt 2020-01-30 20:59:52 UTC (rev 255448)
@@ -0,0 +1 @@
+Tests a display: contents element when selected on computing the style. Test passes if WebKit does not crash. PASS.
Added: trunk/LayoutTests/fast/css/display-contents-detail-selection.html (0 => 255448)
--- trunk/LayoutTests/fast/css/display-contents-detail-selection.html (rev 0)
+++ trunk/LayoutTests/fast/css/display-contents-detail-selection.html 2020-01-30 20:59:52 UTC (rev 255448)
@@ -0,0 +1,11 @@
+<script>
+function jsfuzzer() {
+document.execCommand("selectAll", false);
+
+if (window.testRunner)
+ testRunner.dumpAsText();
+}
+</script>
+<body _onload_=jsfuzzer()>
+<meter readonly="readonly"></meter>
+<details id="a" open="true" rel="noopener" style="display: contents;">Tests a display: contents element when selected on computing the style. Test passes if WebKit does not crash. PASS.</details>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (255447 => 255448)
--- trunk/Source/WebCore/ChangeLog 2020-01-30 20:02:19 UTC (rev 255447)
+++ trunk/Source/WebCore/ChangeLog 2020-01-30 20:59:52 UTC (rev 255448)
@@ -1,3 +1,19 @@
+2020-01-30 Doug Kelly <[email protected]>
+
+ Crash in RenderElement::selectionPseudoStyle with detail element set to display: contents
+ https://bugs.webkit.org/show_bug.cgi?id=206705
+
+ Reviewed by Zalan Bujtas.
+
+ Check the element for a valid renderer before calling getUncachedPseudoStyle(), and if the
+ element is set to "display: contents", walk up to the parent element until we're at the root
+ or the element is not set to "display: contents".
+
+ Test: fast/css/display-contents-detail-selection.html
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::selectionPseudoStyle const):
+
2020-01-30 Ryan Haddad <[email protected]>
Unreviewed, rolling out r255424.
Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (255447 => 255448)
--- trunk/Source/WebCore/rendering/RenderElement.cpp 2020-01-30 20:02:19 UTC (rev 255447)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp 2020-01-30 20:59:52 UTC (rev 255448)
@@ -1413,8 +1413,13 @@
if (ShadowRoot* root = element()->containingShadowRoot()) {
if (root->mode() == ShadowRootMode::UserAgent) {
- if (Element* shadowHost = element()->shadowHost())
- return shadowHost->renderer()->getUncachedPseudoStyle({ PseudoId::Selection });
+ auto* currentElement = element()->shadowHost();
+ // When an element has display: contents, this element doesn't have a renderer
+ // and its children will render as children of the parent element.
+ while (currentElement && currentElement->hasDisplayContents())
+ currentElement = currentElement->parentElement();
+ if (currentElement && currentElement->renderer())
+ return currentElement->renderer()->getUncachedPseudoStyle({ PseudoId::Selection });
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
