Bug 72439
| Summary: | Crash when ShadowRoot content is smaller than host element | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Dominic Cooney <dominicc> |
| Component: | DOM | Assignee: | Dominic Cooney <dominicc> |
| Status: | RESOLVED INVALID | ||
| Severity: | Normal | CC: | morrita |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | |||
| Bug Blocks: | 72352 | ||
Dominic Cooney
When the content of a ShadowRoot is smaller than the host element, clicking in the "void" tries to create a range without an associated DOM element and causes a crash.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Hajime Morrita
Signing up myself.
Hajime Morrita
I cannot reproduce this:
----
<!DOCTYPE html>
<html>
<head>
</head>
<body>
<pre id="console">
</pre>
<div id="container"></div>
<script>
var container = document.getElementById("container");
var shadowHost = document.createElement("div");
shadowHost.setAttribute("style", "width: 500px; height: 500px;");
var shadowRoot = internals.ensureShadowRoot(shadowHost);
content = document.createElement("p");
content.setAttribute("style", "width: 50px; height: 50px;");
shadowRoot.appendChild(content);
container.appendChild(shadowHost);
shadowHost.onclick = function() { console.log('clicked'); }
var p = content;
var x = p.offsetLeft + p.offsetWidth + 10;
var y = p.offsetTop + p.offsetHeight + 10;
eventSender.mouseMoveTo(x , y);
eventSender.mouseDown();
eventSender.mouseUp();
</script>
</body>
</html>
--
This printed "clicked" without any crash.
Hajime Morrita
Unassigning for now because the crash cannot be reproduced.
Dominic Cooney
Let me try to reproduce it.
Dominic Cooney
I can not reproduce this.