Changeset 274064 in webkit

Timestamp:

Mar 8, 2021, 12:59:22 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
​https://bugs.webkit.org/show_bug.cgi?id=222720

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Source/WebCore:

The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.

Test: fast/html/details-set-inner-text-crash.html

• dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):

LayoutTests:

• fast/html/details-set-inner-text-crash-expected.txt: Added.
• fast/html/details-set-inner-text-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/details-set-inner-text-crash-expected.txt (added)
• LayoutTests/fast/html/details-set-inner-text-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ComposedTreeIterator.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=222720
+
+        Reviewed by Ryosuke Niwa.
+
+        * fast/html/details-set-inner-text-crash-expected.txt: Added.
+        * fast/html/details-set-inner-text-crash.html: Added.
+
 2021-03-08  Diego Pino Garcia  <dpino@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=222720
+
+        Reviewed by Ryosuke Niwa.
+
+        The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
+
+        Test: fast/html/details-set-inner-text-crash.html
+
+        * dom/ComposedTreeIterator.cpp:
+        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+
 2021-03-07  Lauro Moura  <lmoura@igalia.com>
 

trunk/Source/WebCore/dom/ComposedTreeIterator.cpp

@@ -163 +163 @@
         auto& slot = downcast<HTMLSlotElement>(current());
         if (auto* assignedNodes = slot.assignedNodes()) {
-            context().slotNodeIndex = 0;
-            auto* assignedNode = assignedNodes->at(0).get();
-            m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
-            return;
+            if (auto assignedNode = assignedNodes->at(0)) {
+                context().slotNodeIndex = 0;
+                m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
+                return;
+            }
         }
     }