Changeset 276398 in webkit

Timestamp:

Apr 21, 2021, 4:39:06 PM (5 years ago)

Author:

Alan Coon

Message:

Cherry-pick r274064. rdar://problem/76962988

REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
​https://bugs.webkit.org/show_bug.cgi?id=222720

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Source/WebCore:

The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.

Test: fast/html/details-set-inner-text-crash.html

• dom/ComposedTreeIterator.cpp: (WebCore::ComposedTreeIterator::traverseNextInShadowTree):

LayoutTests:

• fast/html/details-set-inner-text-crash-expected.txt: Added.
• fast/html/details-set-inner-text-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@274064 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-611-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/details-set-inner-text-crash-expected.txt (added)
• LayoutTests/fast/html/details-set-inner-text-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ComposedTreeIterator.cpp (modified) (1 diff)

branches/safari-611-branch/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-21  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r274064. rdar://problem/76962988
+
+    REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+    https://bugs.webkit.org/show_bug.cgi?id=222720
+    
+    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-03-08
+    Reviewed by Ryosuke Niwa.
+    
+    Source/WebCore:
+    
+    The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
+    
+    Test: fast/html/details-set-inner-text-crash.html
+    
+    * dom/ComposedTreeIterator.cpp:
+    (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+    
+    LayoutTests:
+    
+    * fast/html/details-set-inner-text-crash-expected.txt: Added.
+    * fast/html/details-set-inner-text-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@274064 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+            REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+            https://bugs.webkit.org/show_bug.cgi?id=222720
+
+            Reviewed by Ryosuke Niwa.
+
+            * fast/html/details-set-inner-text-crash-expected.txt: Added.
+            * fast/html/details-set-inner-text-crash.html: Added.
+
 2021-04-15  Russell Epstein  <repstein@apple.com>
 

branches/safari-611-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-21  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r274064. rdar://problem/76962988
+
+    REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+    https://bugs.webkit.org/show_bug.cgi?id=222720
+    
+    Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2021-03-08
+    Reviewed by Ryosuke Niwa.
+    
+    Source/WebCore:
+    
+    The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
+    
+    Test: fast/html/details-set-inner-text-crash.html
+    
+    * dom/ComposedTreeIterator.cpp:
+    (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+    
+    LayoutTests:
+    
+    * fast/html/details-set-inner-text-crash-expected.txt: Added.
+    * fast/html/details-set-inner-text-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@274064 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+            REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+            https://bugs.webkit.org/show_bug.cgi?id=222720
+
+            Reviewed by Ryosuke Niwa.
+
+            The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
+
+            Test: fast/html/details-set-inner-text-crash.html
+
+            * dom/ComposedTreeIterator.cpp:
+            (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+
 2021-04-16  Russell Epstein  <repstein@apple.com>
 

branches/safari-611-branch/Source/WebCore/dom/ComposedTreeIterator.cpp

@@ -163 +163 @@
         auto& slot = downcast<HTMLSlotElement>(current());
         if (auto* assignedNodes = slot.assignedNodes()) {
-            context().slotNodeIndex = 0;
-            auto* assignedNode = assignedNodes->at(0).get();
-            m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
-            return;
+            if (auto assignedNode = assignedNodes->at(0)) {
+                context().slotNodeIndex = 0;
+                m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
+                return;
+            }
         }
     }