Changeset 192763 in webkit

Timestamp:

Nov 24, 2015, 4:40:57 AM (10 years ago)

Author:

Antti Koivisto

Message:

REGRESSION (r190983): Non-element, non-text nodes should not be distributed to slots
​https://bugs.webkit.org/show_bug.cgi?id=151566
rdar://problem/23430177

Reviewed by Zalan Bujtas.

Source/WebCore:

We don't invalidate slot assignments except for text or element children. Fix by not
not assigning other nodes to slots as it is not useful.

Test: fast/html/details-comment-crash.html

• dom/SlotAssignment.cpp:

(WebCore::slotNameFromSlotAttribute):
(WebCore::SlotAssignment::findAssignedSlot):
(WebCore::SlotAssignment::assignSlots):

LayoutTests:

• fast/html/details-comment-crash-expected.html: Added.
• fast/html/details-comment-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/details-comment-crash-expected.html (added)
• LayoutTests/fast/html/details-comment-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/SlotAssignment.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-11-24  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r190983): Non-element, non-text nodes should not be distributed to slots
+        https://bugs.webkit.org/show_bug.cgi?id=151566
+        rdar://problem/23430177
+
+        Reviewed by Zalan Bujtas.
+
+        * fast/html/details-comment-crash-expected.html: Added.
+        * fast/html/details-comment-crash.html: Added.
+
 2015-11-23  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-11-24  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r190983): Non-element, non-text nodes should not be distributed to slots
+        https://bugs.webkit.org/show_bug.cgi?id=151566
+        rdar://problem/23430177
+
+        Reviewed by Zalan Bujtas.
+
+        We don't invalidate slot assignments except for text or element children. Fix by not
+        not assigning other nodes to slots as it is not useful.
+
+        Test: fast/html/details-comment-crash.html
+
+        * dom/SlotAssignment.cpp:
+        (WebCore::slotNameFromSlotAttribute):
+        (WebCore::SlotAssignment::findAssignedSlot):
+        (WebCore::SlotAssignment::assignSlots):
+
 2015-11-23  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/WebCore/dom/SlotAssignment.cpp

@@ -44 +44 @@
 static const AtomicString& slotNameFromSlotAttribute(const Node& child)
 {
-    if (!is<Element>(child))
+    if (is<Text>(child))
         return SlotAssignment::defaultSlotName();
+
     return slotNameFromAttributeValue(downcast<Element>(child).fastGetAttribute(slotAttr));
 }
@@ -61 +62 @@
 HTMLSlotElement* SlotAssignment::findAssignedSlot(const Node& node, ShadowRoot& shadowRoot)
 {
+    if (!is<Text>(node) && !is<Element>(node))
+        return nullptr;
+
     if (!m_slotAssignmentsIsValid)
         assignSlots(shadowRoot);
@@ -221 +225 @@
     auto& host = *shadowRoot.host();
     for (auto* child = host.firstChild(); child; child = child->nextSibling()) {
+        if (!is<Text>(*child) && !is<Element>(*child))
+            continue;
         auto slotName = m_slotNameFunction(*child);
         if (!slotName)