Bug 156281

Summary: ComposedTreeIterator may crash when first child of shadow root is a comment node
Product: WebKit Reporter: Antti Koivisto <koivisto>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, commit-queue, esprehn+autocc, kangil.han
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch kling: review+

Description Antti Koivisto 2016-04-06 01:56:38 PDT
It should not use plain firstChild() and assume it is Element or Text.
Comment 1 Antti Koivisto 2016-04-06 02:00:24 PDT
Created attachment 275761 [details]
patch
Comment 2 Antti Koivisto 2016-04-06 02:29:49 PDT
http://trac.webkit.org/changeset/199097