Changeset 285732 in webkit

Timestamp:

Nov 12, 2021, 11:02:40 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Null check host in SlotAssignment::assignSlots
​https://bugs.webkit.org/show_bug.cgi?id=230899

Patch by Rob Buis <​rbuis@igalia.com> on 2021-11-12
Reviewed by Darin Adler.

Source/WebCore:

Null check host in SlotAssignment::assignSlots.

Tests: fast/shadow-dom/shadow-root-gc-crash.html

• dom/SlotAssignment.cpp:

(WebCore::SlotAssignment::assignSlots):

LayoutTests:

• fast/shadow-dom/shadow-root-gc-crash-expected.txt: Added.
• fast/shadow-dom/shadow-root-gc-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/shadow-dom/shadow-root-gc-crash-expected.txt (added)
• LayoutTests/fast/shadow-dom/shadow-root-gc-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/SlotAssignment.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-12  Rob Buis  <rbuis@igalia.com>
+
+        Null check host in SlotAssignment::assignSlots
+        https://bugs.webkit.org/show_bug.cgi?id=230899
+
+        Reviewed by Darin Adler.
+
+        * fast/shadow-dom/shadow-root-gc-crash-expected.txt: Added.
+        * fast/shadow-dom/shadow-root-gc-crash.html: Added.
+
 2021-11-12  Antoine Quint  <graouts@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-12  Rob Buis  <rbuis@igalia.com>
+
+        Null check host in SlotAssignment::assignSlots
+        https://bugs.webkit.org/show_bug.cgi?id=230899
+
+        Reviewed by Darin Adler.
+
+        Null check host in SlotAssignment::assignSlots.
+
+        Tests: fast/shadow-dom/shadow-root-gc-crash.html
+
+        * dom/SlotAssignment.cpp:
+        (WebCore::SlotAssignment::assignSlots):
+
 2021-11-12  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/dom/SlotAssignment.cpp

@@ -357 +357 @@
         entry.value->assignedNodes.shrink(0);
 
-    auto& host = *shadowRoot.host();
-    for (auto* child = host.firstChild(); child; child = child->nextSibling()) {
-        if (!is<Text>(*child) && !is<Element>(*child))
-            continue;
-        auto slotName = slotNameForHostChild(*child);
-        assignToSlot(*child, slotName);
+    if (auto* host = shadowRoot.host()) {
+        for (auto* child = host->firstChild(); child; child = child->nextSibling()) {
+            if (!is<Text>(*child) && !is<Element>(*child))
+                continue;
+            auto slotName = slotNameForHostChild(*child);
+            assignToSlot(*child, slotName);
+        }
     }