git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 9bc108a)
Crash in addChildNodesToDeletionQueue
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 30 Oct 2017 20:37:37 +0000 (20:37 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 30 Oct 2017 20:37:37 +0000 (20:37 +0000)
https://bugs.webkit.org/show_bug.cgi?id=178974
<rdar://problem/35234372>

Reviewed by Brent Fulgham.

Source/WebCore:

The bug was caused by HTMLConstructionSite::insertTextNode constructing an ill-formed tree
when fostering parent under a template element by adjusting HTMLConstructionSiteTask's parent
without clearing nextChild. Fixed the crash by simply removing this code since executeTask
already takes care of fostering the parent in static inline insert(HTMLConstructionSiteTask&).

Test: fast/parser/foster-parent-under-template.html

* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::insertTextNode):

LayoutTests:

Add a regression test.

* fast/parser/foster-parent-inside-template-expected.txt: Added.
* fast/parser/foster-parent-inside-template.html: Added.
* resources/dump-as-markup.js:
(Markup._get): Fixed the bug that this code would always throw an exception inside a browser.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@224199 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/parser/foster-parent-under-template-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/parser/foster-parent-under-template.html [new file with mode: 0644] patch | blob
LayoutTests/resources/dump-as-markup.js patch | blob | history
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/html/parser/HTMLConstructionSite.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index ca5413d..26d7afa 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2017-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in addChildNodesToDeletionQueue
+        https://bugs.webkit.org/show_bug.cgi?id=178974
+        <rdar://problem/35234372>
+
+        Reviewed by Brent Fulgham.
+
+        Add a regression test.
+
+        * fast/parser/foster-parent-inside-template-expected.txt: Added.
+        * fast/parser/foster-parent-inside-template.html: Added.
+        * resources/dump-as-markup.js:
+        (Markup._get): Fixed the bug that this code would always throw an exception inside a browser.
+
 2017-10-30  Commit Queue  <commit-queue@webkit.org>
 
         Unreviewed, rolling out r224078.
diff --git a/LayoutTests/fast/parser/foster-parent-under-template-expected.txt b/LayoutTests/fast/parser/foster-parent-under-template-expected.txt
new file mode 100644 (file)
index 0000000..117a1f1
--- /dev/null
+++ b/LayoutTests/fast/parser/foster-parent-under-template-expected.txt
@@ -0,0 +1,38 @@
+This tests running the foster parent algorithm under a template element. WebKit should not hit any debug assertions.
+| "
+"
+| <template>
+|   content
+|     "
+        hello
+    "
+|   <table>
+|     "
+    "
+|     <script>
+|       "
+        document.querySelector('template').appendChild(document.querySelector('table'));
+    "
+|     <caption>
+|       "hello"
+|     "
+    "
+|     <tbody>
+|       <tr>
+|         "
+        "
+|         <th>
+|           <shadow>
+|             "hello"
+|         "
+    "
+|       "
+    "
+|       <tr>
+|       "
+"
+| "
+
+
+
+"
diff --git a/LayoutTests/fast/parser/foster-parent-under-template.html b/LayoutTests/fast/parser/foster-parent-under-template.html
new file mode 100644 (file)
index 0000000..6812f3e
--- /dev/null
+++ b/LayoutTests/fast/parser/foster-parent-under-template.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../resources/dump-as-markup.js"></script>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+    Markup.description('This tests running the foster parent algorithm under a template element. WebKit should not hit any debug assertions.');
+    Markup.dump(document.body);
+});
+</script>
+</head>
+<body>
+<template></template>
+<table>
+    <script>
+        document.querySelector('template').appendChild(document.querySelector('table'));
+    </script><caption>hello</caption>
+    <tr>
+        <th><shadow>hello</shadow></th>
+    </tr>
+    <tr>
+        hello
+    </tr>
+</table>
+</body>
+</html>
diff --git a/LayoutTests/resources/dump-as-markup.js b/LayoutTests/resources/dump-as-markup.js
index b73e35c..369554a 100644 (file)
--- a/LayoutTests/resources/dump-as-markup.js
+++ b/LayoutTests/resources/dump-as-markup.js
@@ -223,7 +223,7 @@ Markup._get = function(node, depth, shadowRootList)
 
         break;
     case Node.DOCUMENT_FRAGMENT_NODE:
-        if (shadowRootList && internals.address(node) in shadowRootList)
+        if (shadowRootList && window.internals && internals.address(node) in shadowRootList)
           str += "<shadow:root>";
         else
           str += "content";
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 21f5736..3bf01e0 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,21 @@
+2017-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in addChildNodesToDeletionQueue
+        https://bugs.webkit.org/show_bug.cgi?id=178974
+        <rdar://problem/35234372>
+
+        Reviewed by Brent Fulgham.
+
+        The bug was caused by HTMLConstructionSite::insertTextNode constructing an ill-formed tree
+        when fostering parent under a template element by adjusting HTMLConstructionSiteTask's parent
+        without clearing nextChild. Fixed the crash by simply removing this code since executeTask
+        already takes care of fostering the parent in static inline insert(HTMLConstructionSiteTask&).
+
+        Test: fast/parser/foster-parent-under-template.html
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertTextNode):
+
 2017-10-30  Commit Queue  <commit-queue@webkit.org>
 
         Unreviewed, rolling out r224078.
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index c81a9af..fdd28c5 100644 (file)
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -573,9 +573,6 @@ void HTMLConstructionSite::insertTextNode(const String& characters, WhitespaceMo
     if (shouldFosterParent())
         findFosterSite(task);
 
-    if (is<HTMLTemplateElement>(*task.parent))
-        task.parent = &downcast<HTMLTemplateElement>(*task.parent).content();
-
     // Strings composed entirely of whitespace are likely to be repeated.
     // Turn them into AtomicString so we share a single string for each.
     bool shouldUseAtomicString = whitespaceMode == AllWhitespace || (whitespaceMode == WhitespaceUnknown && isAllWhitespace(characters));
Mirror of the WebKit open source project from svn.webkit.org.