|Summary:||[Chromium] toV8(Node*) will enter infinite recursion when called with a node of type SHADOW_ROOT_NODE|
|Product:||WebKit||Reporter:||Andrey Kosyakov <caseq>|
|Component:||DOM||Assignee:||Andrey Kosyakov <caseq>|
|Severity:||Normal||CC:||antonm, dglazkov, rolandsteiner|
|Version:||528+ (Nightly build)|
Description Andrey Kosyakov 2011-05-03 08:09:15 PDT
There's no IDL class for ShadowRoot, hence there's no toV8(ShadowRoot*) overload, and the following lines in toV8Slow(Node*): http://trac.webkit.org/browser/trunk/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp?rev=84520#L168 case Node::SHADOW_ROOT_NODE: return toV8(static_cast<ShadowRoot*>(impl), forceNewObject); will resolve toV8() to toV8(Node*), which will invoke toV8Slow(Node*) etc. This isn't normally exposed, as we do not expose ShadowRoot nodes in bindings -- yet this popped up when I started adding shadow DOM support to inspector, as one can access last inspected node in console via $0.
Comment 2 anton muhin 2011-05-03 08:23:42 PDT
LGTM, maybe rearrange cases to have a fall-through to default case.
Comment 3 Dimitri Glazkov (Google) 2011-05-03 08:39:44 PDT
Comment on attachment 92079 [details] patch with antonm's suggestion.