Changeset 280832 in webkit

Timestamp:

Aug 10, 2021, 2:22:53 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r274064 - REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
​https://bugs.webkit.org/show_bug.cgi?id=222720

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Source/WebCore:

The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.

Test: fast/html/details-set-inner-text-crash.html

• dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):

LayoutTests:

• fast/html/details-set-inner-text-crash-expected.txt: Added.
• fast/html/details-set-inner-text-crash.html: Added.

Location:

releases/WebKitGTK/webkit-2.32

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/details-set-inner-text-crash-expected.txt (added)
• LayoutTests/fast/html/details-set-inner-text-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ComposedTreeIterator.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog

@@ +1 @@
+2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=222720
+
+        Reviewed by Ryosuke Niwa.
+
+        * fast/html/details-set-inner-text-crash-expected.txt: Added.
+        * fast/html/details-set-inner-text-crash.html: Added.
+
 2021-04-15  Youenn Fablet  <youenn@apple.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=222720
+
+        Reviewed by Ryosuke Niwa.
+
+        The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.
+
+        Test: fast/html/details-set-inner-text-crash.html
+
+        * dom/ComposedTreeIterator.cpp:
+        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
+
 2021-03-04  Julian Gonzalez  <julian_a_gonzalez@apple.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebCore/dom/ComposedTreeIterator.cpp

@@ -163 +163 @@
         auto& slot = downcast<HTMLSlotElement>(current());
         if (auto* assignedNodes = slot.assignedNodes()) {
-            context().slotNodeIndex = 0;
-            auto* assignedNode = assignedNodes->at(0).get();
-            m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
-            return;
+            if (auto assignedNode = assignedNodes->at(0)) {
+                context().slotNodeIndex = 0;
+                m_contextStack.append(Context(*assignedNode->parentElement(), *assignedNode, Context::Slotted));
+                return;
+            }
         }
     }