Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-08 22:08:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1324463. Fix crash when xbl:children is stuck into shadow DOM. r=smaug

Browse Source 
MozReview-Commit-ID: C602pPbIfih
This commit is contained in:
Boris Zbarsky 2017-10-11 22:19:10 -04:00
parent 320337bba3
commit 3fc7b4c919
3 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
dom/base/ShadowRoot.cpp
View File

@ -508,7 +508,7 @@ ShadowRoot::ContentAppended(nsIDocument* aDocument,
// Add insertion point to destination insertion points of fallback content.
if (nsContentUtils::IsContentInsertionPoint(aContainer)) {
HTMLContentElement* content = HTMLContentElement::FromContent(aContainer);
if (content->MatchedNodes().IsEmpty()) {
if (content && content->MatchedNodes().IsEmpty()) {
currentChild->DestInsertionPoints().AppendElement(aContainer);
}
}
@ -538,7 +538,7 @@ ShadowRoot::ContentInserted(nsIDocument* aDocument,
// Add insertion point to destination insertion points of fallback content.
if (nsContentUtils::IsContentInsertionPoint(aContainer)) {
HTMLContentElement* content = HTMLContentElement::FromContent(aContainer);
if (content->MatchedNodes().IsEmpty()) {
if (content && content->MatchedNodes().IsEmpty()) {
aChild->DestInsertionPoints().AppendElement(aContainer);
}
}
@ -563,7 +563,7 @@ ShadowRoot::ContentRemoved(nsIDocument* aDocument,
// fallback content.
if (nsContentUtils::IsContentInsertionPoint(aContainer)) {
HTMLContentElement* content = HTMLContentElement::FromContent(aContainer);
if (content->MatchedNodes().IsEmpty()) {
if (content && content->MatchedNodes().IsEmpty()) {
aChild->DestInsertionPoints().Clear();
}
}

16
dom/base/crashtests/1324463.html Normal file
View File

@ -0,0 +1,16 @@
<!DOCTYPE html>
<html>
<script>
// requires: user_pref("dom.webcomponents.enabled", true);
addEventListener("DOMContentLoaded", function(){
let o_0 = document.createElement("span").createShadowRoot();
let o_1 = document.createElementNS("http://www.mozilla.org/xbl", "binding");
let o_2 = document.createElementNS("http://www.mozilla.org/xbl", "children");
let o_3 = document.createTextNode("");
o_0.appendChild(o_1);
o_1.appendChild(o_2);
o_2.appendChild(o_3);
o_2.removeChild(o_3);
});
</script>
</html>

1
dom/base/crashtests/crashtests.list
View File

@ -231,3 +231,4 @@ load 1400701.html
load 1403377.html
load 1405771.html
load 1406109-1.html
pref(dom.webcomponents.enabled,true) load 1324463.html