git://git.webkit.org / WebKit.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: e7050d0)
REGRESSION(r190430): Assertion failure in Text::~Text()
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jan 2016 04:42:36 +0000 (04:42 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jan 2016 04:42:36 +0000 (04:42 +0000)
https://bugs.webkit.org/show_bug.cgi?id=153577

Reviewed by Antti Koivisto.

Source/WebCore:

The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.

Test: fast/shadow-dom/slot-removal-crash-2.html

* dom/ContainerNode.cpp:
(WebCore::destroyRenderTreeIfNeeded):

LayoutTests:

Added a regression test. The test hits an assertion in debug build without the fix.

* fast/shadow-dom/slot-removal-crash-2-expected.txt: Added.
* fast/shadow-dom/slot-removal-crash-2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@195727 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/shadow-dom/slot-removal-crash-2-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/shadow-dom/slot-removal-crash-2.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/dom/ContainerNode.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1ab8ab3..a6b06f2 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r190430): Assertion failure in Text::~Text()
+        https://bugs.webkit.org/show_bug.cgi?id=153577
+
+        Reviewed by Antti Koivisto.
+
+        Added a regression test. The test hits an assertion in debug build without the fix.
+
+        * fast/shadow-dom/slot-removal-crash-2-expected.txt: Added.
+        * fast/shadow-dom/slot-removal-crash-2.html: Added.
+
 2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>
 
         Garbage is displayed when root svg element has mix-blend-mode set
diff --git a/LayoutTests/fast/shadow-dom/slot-removal-crash-2-expected.txt b/LayoutTests/fast/shadow-dom/slot-removal-crash-2-expected.txt
new file mode 100644 (file)
index 0000000..1766970
--- /dev/null
+++ b/LayoutTests/fast/shadow-dom/slot-removal-crash-2-expected.txt
@@ -0,0 +1,5 @@
+Test that removing a slot element with text node does not result in an assertion failure.
+The test passes if WebKit does not hit an assertion.
+PASS.
+
+
diff --git a/LayoutTests/fast/shadow-dom/slot-removal-crash-2.html b/LayoutTests/fast/shadow-dom/slot-removal-crash-2.html
new file mode 100644 (file)
index 0000000..9e1148a
--- /dev/null
+++ b/LayoutTests/fast/shadow-dom/slot-removal-crash-2.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test that removing a slot element with text node does not result in an assertion failure.<br>
+The test passes if WebKit does not hit an assertion.</p>
+<script>
+
+if (window.testRunner) {
+    testRunner.waitUntilDone();
+    testRunner.dumpAsText();
+}
+
+var iframe = document.createElement('iframe');
+document.body.appendChild(iframe);
+
+var x;
+
+function runTest() {
+    var doc = iframe.contentDocument;
+
+    var host = doc.createElement('div');
+    var shadowRoot = host.attachShadow({mode: 'open'});
+    var slot = doc.createElement('slot');
+    slot.textContent = 'hello';
+    shadowRoot.appendChild(slot);
+    doc.body.appendChild(host);
+
+    setTimeout(function () {
+        x = slot.offsetTop;
+        shadowRoot.removeChild(slot);
+    }, 0);
+}
+
+runTest();
+
+setTimeout(function () {
+    iframe.src = 'about:blank';
+    x = document.body.offsetTop;
+    if (window.GCController)
+        GCController.collect();
+
+    document.querySelector('p').innerHTML += '<br>PASS.';
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+}, 0);
+
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 45693b7..21222b2 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r190430): Assertion failure in Text::~Text()
+        https://bugs.webkit.org/show_bug.cgi?id=153577
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
+        Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.
+
+        Test: fast/shadow-dom/slot-removal-crash-2.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::destroyRenderTreeIfNeeded):
+
 2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>
 
         Garbage is displayed when root svg element has mix-blend-mode set
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 1b04649..d23a482 100644 (file)
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -35,6 +35,7 @@
 #include "GenericCachedHTMLCollection.h"
 #include "HTMLFormControlsCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "HTMLSlotElement.h"
 #include "HTMLTableRowsCollection.h"
 #include "InlineTextBox.h"
 #include "JSLazyEventListener.h"
@@ -99,7 +100,7 @@ void ContainerNode::removeDetachedChildren()
 static inline void destroyRenderTreeIfNeeded(Node& child)
 {
     // FIXME: Get rid of the named flow test.
-    if (!child.renderer() && !child.isNamedFlowContentNode())
+    if (!child.renderer() && !child.isNamedFlowContentNode() && !is<HTMLSlotElement>(child))
         return;
     if (is<Element>(child))
         Style::detachRenderTree(downcast<Element>(child));
Mirror of the WebKit open source project on svn.webkit.org.