Title: [280832] releases/WebKitGTK/webkit-2.32
- Revision
- 280832
- Author
- [email protected]
- Date
- 2021-08-10 02:22:53 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r274064 - REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
https://bugs.webkit.org/show_bug.cgi?id=222720
Patch by Carlos Garcia Campos <[email protected]> on 2021-03-08
Reviewed by Ryosuke Niwa.
Source/WebCore:
The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
Test: fast/html/details-set-inner-text-crash.html
* dom/ComposedTreeIterator.cpp:
(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
LayoutTests:
* fast/html/details-set-inner-text-crash-expected.txt: Added.
* fast/html/details-set-inner-text-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog (280831 => 280832)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog 2021-08-10 09:22:45 UTC (rev 280831)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog 2021-08-10 09:22:53 UTC (rev 280832)
@@ -1,3 +1,13 @@
+2021-03-08 Carlos Garcia Campos <[email protected]>
+
+ REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+ https://bugs.webkit.org/show_bug.cgi?id=222720
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/html/details-set-inner-text-crash-expected.txt: Added.
+ * fast/html/details-set-inner-text-crash.html: Added.
+
2021-04-15 Youenn Fablet <[email protected]>
REGRESSION(Safari 14): iframe with blob url does not work with sandboxing
Added: releases/WebKitGTK/webkit-2.32/LayoutTests/fast/html/details-set-inner-text-crash-expected.txt (0 => 280832)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/fast/html/details-set-inner-text-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/fast/html/details-set-inner-text-crash-expected.txt 2021-08-10 09:22:53 UTC (rev 280832)
@@ -0,0 +1 @@
+PASS
Added: releases/WebKitGTK/webkit-2.32/LayoutTests/fast/html/details-set-inner-text-crash.html (0 => 280832)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/fast/html/details-set-inner-text-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/fast/html/details-set-inner-text-crash.html 2021-08-10 09:22:53 UTC (rev 280832)
@@ -0,0 +1,17 @@
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function test() {
+ x4.click();
+ x4.innerText = "PASS";
+}
+
+function on_details_click() {
+ x4.prepend(document.getElementById("x43"));
+ x70.addEventListener("DOMNodeRemoved", on_details_click);
+}
+</script>
+<body _onload_="test()">
+<details id="x4" open="" _onclick_="on_details_click()">
+<summary id="x70" hidden="">
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (280831 => 280832)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-10 09:22:45 UTC (rev 280831)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-10 09:22:53 UTC (rev 280832)
@@ -1,3 +1,17 @@
+2021-03-08 Carlos Garcia Campos <[email protected]>
+
+ REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+ https://bugs.webkit.org/show_bug.cgi?id=222720
+
+ Reviewed by Ryosuke Niwa.
+
+ The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
+
+ Test: fast/html/details-set-inner-text-crash.html
+
+ * dom/ComposedTreeIterator.cpp:
+ (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+
2021-03-04 Julian Gonzalez <[email protected]>
Deploy Ref<T> in SVGUseElement.cpp
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/dom/ComposedTreeIterator.cpp (280831 => 280832)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/dom/ComposedTreeIterator.cpp 2021-08-10 09:22:45 UTC (rev 280831)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/dom/ComposedTreeIterator.cpp 2021-08-10 09:22:53 UTC (rev 280832)
@@ -162,10 +162,11 @@
if (is<HTMLSlotElement>(current())) {
auto& slot = downcast<HTMLSlotElement>(current());
if (auto* assignedNodes = slot.assignedNodes()) {
- context().slotNodeIndex = 0;
- auto* assignedNode = assignedNodes->at(0).get();
- m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
- return;
+ if (auto assignedNode = assignedNodes->at(0)) {
+ context().slotNodeIndex = 0;
+ m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
+ return;
+ }
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
