Bug 1522809 - Nodes with name="attributes" break the markup view r=rcaliman

This is another very specific issue.

If you have `<img name="attributes"/>` in the dom then `document.attributes` will return the `<img>` tag.

In the source we bail if `!this.rawNode.attributes` but if we are on the document node this returns the image tag. Because the image tag is not a `NamedNodeMap` trying to iterate over the tag throws the error.

There is a test file [here](https://bugzilla.mozilla.org/attachment.cgi?id=9040577).

Differential Revision: https://phabricator.services.mozilla.com/D18340

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Michael Ratcliffe 2019-02-01 14:03:44 +00:00
parent 67c71cede9
commit ed1053338d
2 changed files with 6 additions and 1 deletions

View File

@ -293,7 +293,10 @@ const NodeActor = protocol.ActorClassWithSpec(nodeSpec, {
},
writeAttrs: function() {
if (!this.rawNode.attributes) {
// If the node has no attributes or this.rawNode is the document node and a
// node with `name="attributes"` exists in the DOM we need to bail.
if (!this.rawNode.attributes ||
!(this.rawNode.attributes instanceof NamedNodeMap)) {
return undefined;
}

View File

@ -24,6 +24,7 @@ const {
DOMQuad,
DOMRect,
HeapSnapshot,
NamedNodeMap,
NodeFilter,
StructuredCloneHolder,
TelemetryStopwatch,
@ -291,6 +292,7 @@ exports.globals = {
DOMParser,
DOMPoint,
DOMQuad,
NamedNodeMap,
NodeFilter,
DOMRect,
Element,