Changeset 138923 in webkit

Timestamp:

Jan 6, 2013 10:10:27 PM (11 years ago)

Author:

tasak@google.com

Message:

[Shadow DOM]: crash in WebCore::ElementShadow::setValidityUndetermined
​https://bugs.webkit.org/show_bug.cgi?id=106203

Reviewed by Hajime Morita.

InsertionPoint should check whether ElementShadow is available or not
before invoking its methods.

No new tests. Webcomponents_fuzzer reported this bug. Would like to
use the fuzzer to check this issue.

• html/shadow/InsertionPoint.cpp:

(WebCore::InsertionPoint::getDistributedNodes):
(WebCore::InsertionPoint::childrenChanged):
(WebCore::InsertionPoint::insertedInto):
Added ifs to check whether ElementShadow is available or not before
invoking ElementShadow's methods, i.e. setValidityUndetermined,
invalidateDistribution, and ensureDistributionDocument.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/shadow/InsertionPoint.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-06  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow DOM]: crash in WebCore::ElementShadow::setValidityUndetermined
+        https://bugs.webkit.org/show_bug.cgi?id=106203
+
+        Reviewed by Hajime Morita.
+
+        InsertionPoint should check whether ElementShadow is available or not
+        before invoking its methods.
+
+        No new tests. Webcomponents_fuzzer reported this bug. Would like to
+        use the fuzzer to check this issue.
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::getDistributedNodes):
+        (WebCore::InsertionPoint::childrenChanged):
+        (WebCore::InsertionPoint::insertedInto):
+        Added ifs to check whether ElementShadow is available or not before
+        invoking ElementShadow's methods, i.e. setValidityUndetermined,
+        invalidateDistribution, and ensureDistributionDocument.
+
 2013-01-06  Shinya Kawanaka  <shinyak@chromium.org>
 

trunk/Source/WebCore/html/shadow/InsertionPoint.cpp

@@ -100 +100 @@
 PassRefPtr<NodeList> InsertionPoint::getDistributedNodes() const
 {
-    if (treeScope()->rootNode()->isShadowRoot())
-        toShadowRoot(treeScope()->rootNode())->owner()->ensureDistributionFromDocument();
+    ContainerNode* rootNode = treeScope()->rootNode();
+    if (rootNode->isShadowRoot())
+        if (ElementShadow* rootOwner = toShadowRoot(rootNode)->owner())
+            rootOwner->ensureDistributionFromDocument();
 
     Vector<RefPtr<Node> > nodes;
@@ -120 +122 @@
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     if (ShadowRoot* root = containingShadowRoot())
-        root->owner()->invalidateDistribution();
+        if (ElementShadow* rootOwner = root->owner())
+            rootOwner->invalidateDistribution();
 }
 
@@ -128 +131 @@
 
     if (ShadowRoot* root = containingShadowRoot()) {
-        root->owner()->setValidityUndetermined();
-        root->owner()->invalidateDistribution();
-        if (isActive() && !m_registeredWithShadowRoot && insertionPoint->treeScope()->rootNode() == root) {
-            m_registeredWithShadowRoot = true;
-            root->registerInsertionPoint(this);
+        if (ElementShadow* rootOwner = root->owner()) {
+            rootOwner->setValidityUndetermined();
+            rootOwner->invalidateDistribution();
+            if (isActive() && !m_registeredWithShadowRoot && insertionPoint->treeScope()->rootNode() == root) {
+                m_registeredWithShadowRoot = true;
+                root->registerInsertionPoint(this);
+            }
         }
     }
-
 
     return InsertionDone;