Bug 60026 - [Chromium] toV8(Node*) will enter infinite recursion when called with a node of type SHADOW_ROOT_NODE
Summary: [Chromium] toV8(Node*) will enter infinite recursion when called with a node ...
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P2 Normal
Assignee: Andrey Kosyakov
Depends on:
Reported: 2011-05-03 08:09 PDT by Andrey Kosyakov
Modified: 2011-05-03 09:20 PDT (History)
3 users (show)

See Also:

patch (1.54 KB, patch)
2011-05-03 08:19 PDT, Andrey Kosyakov
dglazkov: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andrey Kosyakov 2011-05-03 08:09:15 PDT
There's no IDL class for ShadowRoot, hence there's no toV8(ShadowRoot*) overload, and the following lines in toV8Slow(Node*):

    case Node::SHADOW_ROOT_NODE:
        return toV8(static_cast<ShadowRoot*>(impl), forceNewObject);

will resolve toV8() to toV8(Node*), which will invoke toV8Slow(Node*) etc.
This isn't normally exposed, as we do not expose ShadowRoot nodes in bindings -- yet this popped up when I started adding shadow DOM support to inspector, as one can access last inspected node in console via $0.
Comment 1 Andrey Kosyakov 2011-05-03 08:19:35 PDT
Created attachment 92079 [details]
Comment 2 anton muhin 2011-05-03 08:23:42 PDT
LGTM, maybe rearrange cases to have a fall-through to default case.
Comment 3 Dimitri Glazkov (Google) 2011-05-03 08:39:44 PDT
Comment on attachment 92079 [details]

with antonm's suggestion.
Comment 4 Andrey Kosyakov 2011-05-03 09:20:19 PDT
(In reply to comment #3)
> (From update of attachment 92079 [details])
> with antonm's suggestion.

Manually committed r85606 (changed as per Anton's comment): http://trac.webkit.org/changeset/85606