Bug 156281

Summary: ComposedTreeIterator may crash when first child of shadow root is a comment node
Product: WebKit Reporter: Antti Koivisto <koivisto>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, commit-queue, esprehn+autocc, kangil.han
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch kling: review+

Antti Koivisto
Reported 2016-04-06 01:56:38 PDT
It should not use plain firstChild() and assume it is Element or Text.
Attachments
patch (9.80 KB, patch)
2016-04-06 02:00 PDT, Antti Koivisto 		kling: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Antti Koivisto
Comment 1 2016-04-06 02:00:24 PDT
Created attachment 275761 [details] patch
Antti Koivisto
Comment 2 2016-04-06 02:29:49 PDT
http://trac.webkit.org/changeset/199097
Note You need to log in before you can comment on or make changes to this bug.