Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-08 19:04:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1118764 - Don't distribute anonymous root content in shadow DOM. r=bz

Browse Source
This commit is contained in:
William Chen 2015-01-08 13:49:51 -08:00
parent f00cdbf88e
commit 35698aefb1
4 changed files with 42 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
dom/base/FragmentOrElement.cpp
View File

@ -154,7 +154,8 @@ nsIContent::GetFlattenedTreeParent() const
{
nsIContent* parent = GetParent();
if (nsContentUtils::HasDistributedChildren(parent)) {
if (parent && nsContentUtils::HasDistributedChildren(parent) &&
nsContentUtils::IsInSameAnonymousTree(parent, this)) {
// This node is distributed to insertion points, thus we
// need to consult the destination insertion points list to
// figure out where this node was inserted in the flattened tree.

8
dom/base/ShadowRoot.cpp
View File

@ -588,8 +588,12 @@ ShadowRoot::IsPooledNode(nsIContent* aContent, nsIContent* aContainer,
return false;
}
if (aContainer == aHost) {
// Any other child nodes of the host will end up in the pool.
if (aContainer == aHost &&
nsContentUtils::IsInSameAnonymousTree(aContainer, aContent)) {
// Children of the host will end up in the pool. We check to ensure
// that the content is in the same anonymous tree as the container
// because anonymous content may report its container as the host
// but it may not be in the host's child list.
return true;
}

33
dom/base/crashtests/1118764.html Normal file
View File

@ -0,0 +1,33 @@
<!DOCTYPE html>
<html>
<body>
<style>
#foo {
overflow: scroll;
height: 100px;
}
</style>
<div id="foo">
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
Mozilla Firefox<br>
<script>
foo.createShadowRoot().innerHTML = "<content></content>";
</script>
</body>
</html>

2
layout/generic/nsPlaceholderFrame.cpp
View File

@ -194,7 +194,7 @@ nsPlaceholderFrame::GetParentStyleContext(nsIFrame** aProviderFrame) const
{
NS_PRECONDITION(GetParent(), "How can we not have a parent here?");
nsIContent* parentContent = mContent ? mContent->GetParent() : nullptr;
nsIContent* parentContent = mContent ? mContent->GetFlattenedTreeParent() : nullptr;
if (parentContent) {
nsStyleContext* sc =
PresContext()->FrameManager()->GetDisplayContentsStyleFor(parentContent);