Bug 149365 – Inserting or removing slot elements can cause a crash

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Ryosuke Niwa]

HTMLSlotElement::insertedInto and HTMLSlotElement::removedFrom are completely wrong.

[Ryosuke Niwa]

Created attachment 261561 [details]
Fixes the bug

[Antti Koivisto]

Comment on attachment 261561 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=261561&action=review

> Source/WebCore/html/HTMLSlotElement.cpp:52
> +    if (insertionPoint.isInShadowTree() && isInShadowTree() && &insertionPoint.treeScope() == &treeScope()) {

This could use a comment.

> Source/WebCore/html/HTMLSlotElement.cpp:53
> +        if (auto shadowRoot = containingShadowRoot())

auto*

> Source/WebCore/html/HTMLSlotElement.cpp:63
>      // Can't call containingShadowRoot() here since this node has already been disconnected from the parent.
> -    if (isInShadowTree()) {
> -        auto& oldShadowRoot = downcast<ShadowRoot>(insertionPoint.treeScope().rootNode());
> -        oldShadowRoot.removeSlotElementByName(fastGetAttribute(nameAttr), *this);
> +    if (insertionPoint.isInShadowTree() && isInShadowTree() && &treeScope() == &document()) {

This could use a bit more comprehensive comment.

[Ryosuke Niwa]

Created attachment 261563 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 261563 [details]
Patch for landing

Rejecting attachment 261563 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-02', 'validate-changelog', '--check-oops', '--non-interactive', 261563, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: http://webkit-queues.webkit.org/results/185244

[Ryosuke Niwa]

Created attachment 261564 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 261564 [details]
Patch for landing

Clearing flags on attachment: 261564

Committed r190008: <http://trac.webkit.org/changeset/190008>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.