ShadowRoot with leading or trailing white space cause a crash
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 5 Oct 2015 22:49:34 +0000 (22:49 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 5 Oct 2015 22:49:34 +0000 (22:49 +0000)
https://bugs.webkit.org/show_bug.cgi?id=149782

Reviewed by Chris Dumez.

Source/WebCore:

Fixed the crash by adding a null pointer check since a TextNode that appears as a direct child
of a ShadowRoot doesn't have a parent element.

Test: fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html

* style/RenderTreePosition.cpp:
(WebCore::RenderTreePosition::previousSiblingRenderer):

LayoutTests:

Added a regression test.

* fast/shadow-dom/shadow-root-with-child-whitespace-text-crash-expected.txt: Added.
* fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@190585 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/shadow-dom/shadow-root-with-child-whitespace-text-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/style/RenderTreePosition.cpp

index b9eae3e..599cc20 100644 (file)
@@ -1,3 +1,15 @@
+2015-10-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        ShadowRoot with leading or trailing white space cause a crash
+        https://bugs.webkit.org/show_bug.cgi?id=149782
+
+        Reviewed by Chris Dumez.
+
+        Added a regression test.
+
+        * fast/shadow-dom/shadow-root-with-child-whitespace-text-crash-expected.txt: Added.
+        * fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html: Added.
+
 2015-10-05  Jiewen Tan  <jiewen_tan@apple.com>
 
         Cleaning up after revision 190339
diff --git a/LayoutTests/fast/shadow-dom/shadow-root-with-child-whitespace-text-crash-expected.txt b/LayoutTests/fast/shadow-dom/shadow-root-with-child-whitespace-text-crash-expected.txt
new file mode 100644 (file)
index 0000000..c10c94b
--- /dev/null
@@ -0,0 +1,3 @@
+This tests creating a shadow root with leading and trailing white spaces. WebKit should not crash. You should see PASS below.
+
+PASS
diff --git a/LayoutTests/fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html b/LayoutTests/fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html
new file mode 100644 (file)
index 0000000..b383491
--- /dev/null
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>
+This tests creating a shadow root with leading and trailing white spaces.
+WebKit should not crash. You should see PASS below.
+</p>
+<div id="host">PASS</div>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var host = document.getElementById('host');
+host.attachShadow({mode: 'closed'}).innerHTML = ' <slot></slot> ';
+</script>
+</body>
+</html>
index 704c573..95d96d0 100644 (file)
@@ -1,3 +1,18 @@
+2015-10-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        ShadowRoot with leading or trailing white space cause a crash
+        https://bugs.webkit.org/show_bug.cgi?id=149782
+
+        Reviewed by Chris Dumez.
+
+        Fixed the crash by adding a null pointer check since a TextNode that appears as a direct child
+        of a ShadowRoot doesn't have a parent element.
+
+        Test: fast/shadow-dom/shadow-root-with-child-whitespace-text-crash.html
+
+        * style/RenderTreePosition.cpp:
+        (WebCore::RenderTreePosition::previousSiblingRenderer):
+
 2015-10-05  Beth Dakin  <bdakin@apple.com>
 
         Build fix. 
index af9b913..751e33d 100644 (file)
@@ -62,8 +62,10 @@ RenderObject* RenderTreePosition::previousSiblingRenderer(const Text& textNode)
         if (renderer && !RenderTreePosition::isRendererReparented(*renderer))
             return renderer;
     }
-    if (PseudoElement* before = textNode.parentElement()->beforePseudoElement())
-        return before->renderer();
+    if (auto* parent = textNode.parentElement()) {
+        if (auto* before = parent->beforePseudoElement())
+            return before->renderer();
+    }
     return nullptr;
 }