Changeset 195727 in webkit

Timestamp:

Jan 27, 2016 8:42:36 PM (8 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION(r190430): Assertion failure in Text::~Text()
​https://bugs.webkit.org/show_bug.cgi?id=153577

Reviewed by Antti Koivisto.

Source/WebCore:

The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.

Test: fast/shadow-dom/slot-removal-crash-2.html

• dom/ContainerNode.cpp:

(WebCore::destroyRenderTreeIfNeeded):

LayoutTests:

Added a regression test. The test hits an assertion in debug build without the fix.

• fast/shadow-dom/slot-removal-crash-2-expected.txt: Added.
• fast/shadow-dom/slot-removal-crash-2.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/shadow-dom/slot-removal-crash-2-expected.txt (added)
• LayoutTests/fast/shadow-dom/slot-removal-crash-2.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ContainerNode.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r190430): Assertion failure in Text::~Text()
+        https://bugs.webkit.org/show_bug.cgi?id=153577
+
+        Reviewed by Antti Koivisto.
+
+        Added a regression test. The test hits an assertion in debug build without the fix.
+
+        * fast/shadow-dom/slot-removal-crash-2-expected.txt: Added.
+        * fast/shadow-dom/slot-removal-crash-2.html: Added.
+
 2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r190430): Assertion failure in Text::~Text()
+        https://bugs.webkit.org/show_bug.cgi?id=153577
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
+        Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.
+
+        Test: fast/shadow-dom/slot-removal-crash-2.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::destroyRenderTreeIfNeeded):
+
 2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>
 

trunk/Source/WebCore/dom/ContainerNode.cpp

@@ -36 +36 @@
 #include "HTMLFormControlsCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "HTMLSlotElement.h"
 #include "HTMLTableRowsCollection.h"
 #include "InlineTextBox.h"
@@ -100 +101 @@
 {
     // FIXME: Get rid of the named flow test.
-    if (!child.renderer() && !child.isNamedFlowContentNode())
+    if (!child.renderer() && !child.isNamedFlowContentNode() && !is<HTMLSlotElement>(child))
         return;
     if (is<Element>(child))