Changeset 277373 in webkit

Timestamp:

May 12, 2021, 10:13:20 AM (5 years ago)

Author:

rniwa@webkit.org

Message:

Source/WebCore:
REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree
in Element::insertedIntoAncestor
​https://bugs.webkit.org/show_bug.cgi?id=225684

Reviewed by Darin Adler.

The release assertion failure was caused by RenderTreeUpdater::tearDownRenderers end up traversing the parts of the DOM
for which Element::insertedIntoAncestor had not been called yet. Since HTMLSlotElement::insertedIntoAncestor is where
SlotAssignment::Slot is updated for a newly inserted slot, SlotAssignment::Slot may not contain this slot element.

Fixed the bug by returning early in SlotAssignment::assignedNodesForSlot when this condition holds, which is when
the shadow root is connected to a document but HTMLSlotElement isn't since its connected flag has not been updated yet.

Test: fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html

• dom/SlotAssignment.cpp:

(WebCore::SlotAssignment::assignedNodesForSlot):

LayoutTests:
REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor
​https://bugs.webkit.org/show_bug.cgi?id=225684

Reviewed by Darin Adler.

Added a regression test.

• fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt: Added.
• fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt (added)
• LayoutTests/fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/SlotAssignment.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-05-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor
+        https://bugs.webkit.org/show_bug.cgi?id=225684
+
+        Reviewed by Darin Adler.
+
+        Added a regression test.
+
+        * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt: Added.
+        * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html: Added.
+
 2021-05-12  Sergio Villar Senin  <svillar@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-05-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree
+        in Element::insertedIntoAncestor
+        https://bugs.webkit.org/show_bug.cgi?id=225684
+
+        Reviewed by Darin Adler.
+
+        The release assertion failure was caused by RenderTreeUpdater::tearDownRenderers end up traversing the parts of the DOM
+        for which Element::insertedIntoAncestor had not been called yet. Since HTMLSlotElement::insertedIntoAncestor is where
+        SlotAssignment::Slot is updated for a newly inserted slot, SlotAssignment::Slot may not contain this slot element.
+
+        Fixed the bug by returning early in SlotAssignment::assignedNodesForSlot when this condition holds, which is when
+        the shadow root is connected to a document but HTMLSlotElement isn't since its connected flag has not been updated yet.
+
+        Test: fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html
+
+        * dom/SlotAssignment.cpp:
+        (WebCore::SlotAssignment::assignedNodesForSlot):
+
 2021-05-12  Peng Liu  <peng.liu6@apple.com>
 

trunk/Source/WebCore/dom/SlotAssignment.cpp

@@ -333 +333 @@
     const AtomString& slotName = slotNameFromAttributeValue(slotElement.attributeWithoutSynchronization(nameAttr));
     auto* slot = m_slots.get(slotName);
+
+    bool hasNotCalledInsertedIntoAncestorOnSlot = shadowRoot.isConnected() && !slotElement.isConnected();
+    if (hasNotCalledInsertedIntoAncestorOnSlot)
+        return nullptr;
     RELEASE_ASSERT(slot);