⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 277377 in webkit


Ignore:
Timestamp:
May 12, 2021, 10:54:07 AM (5 years ago)
Author:
Russell Epstein
Message:

Cherry-pick r277373. rdar://problem/77916543

Source/WebCore:
REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree
in Element::insertedIntoAncestor
​https://bugs.webkit.org/show_bug.cgi?id=225684

Reviewed by Darin Adler.

The release assertion failure was caused by RenderTreeUpdater::tearDownRenderers end up traversing the parts of the DOM
for which Element::insertedIntoAncestor had not been called yet. Since HTMLSlotElement::insertedIntoAncestor is where
SlotAssignment::Slot is updated for a newly inserted slot, SlotAssignment::Slot may not contain this slot element.

Fixed the bug by returning early in SlotAssignment::assignedNodesForSlot when this condition holds, which is when
the shadow root is connected to a document but HTMLSlotElement isn't since its connected flag has not been updated yet.

Test: fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html

  • dom/SlotAssignment.cpp: (WebCore::SlotAssignment::assignedNodesForSlot):

LayoutTests:
REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor
​https://bugs.webkit.org/show_bug.cgi?id=225684

Reviewed by Darin Adler.

Added a regression test.

  • fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt: Added.
  • fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@277373 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-611-branch
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-611-branch/LayoutTests/ChangeLog

    r277193 r277377  
     12021-05-12  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r277373. rdar://problem/77916543
     4
     5    Source/WebCore:
     6    REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree
     7    in Element::insertedIntoAncestor
     8    https://bugs.webkit.org/show_bug.cgi?id=225684
     9   
     10    Reviewed by Darin Adler.
     11   
     12    The release assertion failure was caused by RenderTreeUpdater::tearDownRenderers end up traversing the parts of the DOM
     13    for which Element::insertedIntoAncestor had not been called yet. Since HTMLSlotElement::insertedIntoAncestor is where
     14    SlotAssignment::Slot is updated for a newly inserted slot, SlotAssignment::Slot may not contain this slot element.
     15   
     16    Fixed the bug by returning early in SlotAssignment::assignedNodesForSlot when this condition holds, which is when
     17    the shadow root is connected to a document but HTMLSlotElement isn't since its connected flag has not been updated yet.
     18   
     19    Test: fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html
     20   
     21    * dom/SlotAssignment.cpp:
     22    (WebCore::SlotAssignment::assignedNodesForSlot):
     23   
     24    LayoutTests:
     25    REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor
     26    https://bugs.webkit.org/show_bug.cgi?id=225684
     27   
     28    Reviewed by Darin Adler.
     29   
     30    Added a regression test.
     31   
     32    * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt: Added.
     33    * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html: Added.
     34   
     35   
     36    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277373 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     37
     38    2021-05-12  Ryosuke Niwa  <rniwa@webkit.org>
     39
     40            REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor
     41            https://bugs.webkit.org/show_bug.cgi?id=225684
     42
     43            Reviewed by Darin Adler.
     44
     45            Added a regression test.
     46
     47            * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt: Added.
     48            * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html: Added.
     49
    1502021-05-07  Russell Epstein  <repstein@apple.com>
    251

  • branches/safari-611-branch/Source/WebCore/ChangeLog

    r277193 r277377  
     12021-05-12  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r277373. rdar://problem/77916543
     4
     5    Source/WebCore:
     6    REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree
     7    in Element::insertedIntoAncestor
     8    https://bugs.webkit.org/show_bug.cgi?id=225684
     9   
     10    Reviewed by Darin Adler.
     11   
     12    The release assertion failure was caused by RenderTreeUpdater::tearDownRenderers end up traversing the parts of the DOM
     13    for which Element::insertedIntoAncestor had not been called yet. Since HTMLSlotElement::insertedIntoAncestor is where
     14    SlotAssignment::Slot is updated for a newly inserted slot, SlotAssignment::Slot may not contain this slot element.
     15   
     16    Fixed the bug by returning early in SlotAssignment::assignedNodesForSlot when this condition holds, which is when
     17    the shadow root is connected to a document but HTMLSlotElement isn't since its connected flag has not been updated yet.
     18   
     19    Test: fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html
     20   
     21    * dom/SlotAssignment.cpp:
     22    (WebCore::SlotAssignment::assignedNodesForSlot):
     23   
     24    LayoutTests:
     25    REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor
     26    https://bugs.webkit.org/show_bug.cgi?id=225684
     27   
     28    Reviewed by Darin Adler.
     29   
     30    Added a regression test.
     31   
     32    * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash-expected.txt: Added.
     33    * fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html: Added.
     34   
     35   
     36    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277373 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     37
     38    2021-05-12  Ryosuke Niwa  <rniwa@webkit.org>
     39
     40            REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree
     41            in Element::insertedIntoAncestor
     42            https://bugs.webkit.org/show_bug.cgi?id=225684
     43
     44            Reviewed by Darin Adler.
     45
     46            The release assertion failure was caused by RenderTreeUpdater::tearDownRenderers end up traversing the parts of the DOM
     47            for which Element::insertedIntoAncestor had not been called yet. Since HTMLSlotElement::insertedIntoAncestor is where
     48            SlotAssignment::Slot is updated for a newly inserted slot, SlotAssignment::Slot may not contain this slot element.
     49
     50            Fixed the bug by returning early in SlotAssignment::assignedNodesForSlot when this condition holds, which is when
     51            the shadow root is connected to a document but HTMLSlotElement isn't since its connected flag has not been updated yet.
     52
     53            Test: fast/shadow-dom/insert-host-child-with-slot-renderer-teardown-crash.html
     54
     55            * dom/SlotAssignment.cpp:
     56            (WebCore::SlotAssignment::assignedNodesForSlot):
     57
    1582021-05-07  Russell Epstein  <repstein@apple.com>
    259

  • branches/safari-611-branch/Source/WebCore/dom/SlotAssignment.cpp

    r276404 r277377  
    333333    const AtomString& slotName = slotNameFromAttributeValue(slotElement.attributeWithoutSynchronization(nameAttr));
    334334    auto* slot = m_slots.get(slotName);
     335
     336    bool hasNotCalledInsertedIntoAncestorOnSlot = shadowRoot.isConnected() && !slotElement.isConnected();
     337    if (hasNotCalledInsertedIntoAncestorOnSlot)
     338        return nullptr;
    335339    RELEASE_ASSERT(slot);
    336340
Note: See TracChangeset for help on using the changeset viewer.