Bug 82607 – Shadow DOM is exposed in JS

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Shinya Kawanaka]

Created attachment 134560 [details]
Repro

When getSelection() is called in nested shadow root, shadow dom is exposed in JS level.
This issue won't expose the deepest shadow tree, but the other shadow trees could be exposed.

[Shinya Kawanaka]

Created attachment 135038 [details]
WIP

[Gustavo Noronha (kov)]

Comment on attachment 135038 [details]
WIP

Attachment 135038 [details] did not pass gtk-ews (gtk):
Output: http://queues.webkit.org/results/12310408

[Early Warning System Bot]

Comment on attachment 135038 [details]
WIP

Attachment 135038 [details] did not pass qt-wk2-ews (qt):
Output: http://queues.webkit.org/results/12306590

[Build Bot]

Comment on attachment 135038 [details]
WIP

Attachment 135038 [details] did not pass win-ews (win):
Output: http://queues.webkit.org/results/12306588

[Early Warning System Bot]

Comment on attachment 135038 [details]
WIP

Attachment 135038 [details] did not pass qt-ews (qt):
Output: http://queues.webkit.org/results/12307522

[WebKit Review Bot]

Comment on attachment 135038 [details]
WIP

Attachment 135038 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/12309458

[Gyuyoung Kim]

Comment on attachment 135038 [details]
WIP

Attachment 135038 [details] did not pass efl-ews (efl):
Output: http://queues.webkit.org/results/12313392

[Shinya Kawanaka]

Created attachment 135060 [details]
WIP

[Philippe Normand]

Comment on attachment 135060 [details]
WIP

Attachment 135060 [details] did not pass gtk-ews (gtk):
Output: http://queues.webkit.org/results/12309505

[Build Bot]

Comment on attachment 135060 [details]
WIP

Attachment 135060 [details] did not pass win-ews (win):
Output: http://queues.webkit.org/results/12307566

[Build Bot]

Comment on attachment 135060 [details]
WIP

Attachment 135060 [details] did not pass mac-ews (mac):
Output: http://queues.webkit.org/results/12309508

[Shinya Kawanaka]

Created attachment 135064 [details]
WIP

[Build Bot]

Comment on attachment 135064 [details]
WIP

Attachment 135064 [details] did not pass win-ews (win):
Output: http://queues.webkit.org/results/12311429

[Shinya Kawanaka]

Created attachment 135076 [details]
Patch

[Shinya Kawanaka]

Created attachment 135079 [details]
Patch

[WebKit Review Bot]

Comment on attachment 135079 [details]
Patch

Attachment 135079 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/12311484

New failing tests:
fast/dom/shadow/selection-shouldnt-expose-shadow-dom.html

[WebKit Review Bot]

Created attachment 135096 [details]
Archive of layout-test-results from ec2-cr-linux-01

The attached test failures were seen while running run-webkit-tests on the chromium-ews.
Bot: ec2-cr-linux-01  Port: <class 'webkitpy.common.config.ports.ChromiumXVFBPort'>  Platform: Linux-2.6.35-28-virtual-x86_64-with-Ubuntu-10.10-maverick

[WebKit Review Bot]

Comment on attachment 135079 [details]
Patch

Attachment 135079 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/12313520

New failing tests:
fast/dom/shadow/selection-shouldnt-expose-shadow-dom.html

[WebKit Review Bot]

Created attachment 135108 [details]
Archive of layout-test-results from ec2-cr-linux-03

The attached test failures were seen while running run-webkit-tests on the chromium-ews.
Bot: ec2-cr-linux-03  Port: <class 'webkitpy.common.config.ports.ChromiumXVFBPort'>  Platform: Linux-2.6.35-28-virtual-x86_64-with-Ubuntu-10.10-maverick

[Shinya Kawanaka]

Created attachment 135252 [details]
Patch

[Hajime Morrita]

Comment on attachment 135252 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=135252&action=review

> Source/WebCore/page/DOMSelection.cpp:52
> +    if (!node->treeScope()->rootNode()->isShadowRoot())

It looks there is TreeScope::isShadowRoot(). Does it work for this?

> Source/WebCore/page/DOMSelection.cpp:56
> +    while (shadowAncestor->treeScope()->rootNode()->isShadowRoot())

It looks we can loop over TreeScope instead of Node.

[Shinya Kawanaka]

(In reply to comment #21)
> (From update of attachment 135252 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=135252&action=review
> 
> > Source/WebCore/page/DOMSelection.cpp:52
> > +    if (!node->treeScope()->rootNode()->isShadowRoot())
> 
> It looks there is TreeScope::isShadowRoot(). Does it work for this?

We've removed the function before.

> 
> > Source/WebCore/page/DOMSelection.cpp:56
> > +    while (shadowAncestor->treeScope()->rootNode()->isShadowRoot())
> 
> It looks we can loop over TreeScope instead of Node.

[Hajime Morrita]

(In reply to comment #22)
> (In reply to comment #21)
> > (From update of attachment 135252 [details] [details])
> > View in context: https://bugs.webkit.org/attachment.cgi?id=135252&action=review
> > 
> > > Source/WebCore/page/DOMSelection.cpp:52
> > > +    if (!node->treeScope()->rootNode()->isShadowRoot())
> > 
> > It looks there is TreeScope::isShadowRoot(). Does it work for this?
> 
> We've removed the function before.
Oh I didn't notice that. So how about Node::isInShadowTree() ?

> 
> > 
> > > Source/WebCore/page/DOMSelection.cpp:56
> > > +    while (shadowAncestor->treeScope()->rootNode()->isShadowRoot())
> > 
> > It looks we can loop over TreeScope instead of Node.

[Shinya Kawanaka]

Created attachment 135515 [details]
Patch

[Hajime Morrita]

Comment on attachment 135515 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=135515&action=review

> Source/WebCore/page/DOMSelection.cpp:52
> +    if (!node->treeScope()->rootNode()->isShadowRoot())

can we use isInSahdowTree() here too?

[Shinya Kawanaka]

Created attachment 135743 [details]
Patch for landing

[Shinya Kawanaka]

Committed r113276: <http://trac.webkit.org/changeset/113276>

[Kristóf Kosztyó]

Committed r113302: <http://trac.webkit.org/changeset/113302>

[Zoltan Arvai]

http://trac.webkit.org/changeset/113302(In reply to comment #28)
> Committed r113302: <http://trac.webkit.org/changeset/113302>

Skipped test on Qt because V8 not yet supported on Qt bots:
fast/dom/shadow/selection-shouldnt-expose-shadow-dom.html

[Hajime Morrita]

(In reply to comment #29)
> 
> Skipped test on Qt because V8 not yet supported on Qt bots:
> fast/dom/shadow/selection-shouldnt-expose-shadow-dom.html
Zoltan, thanks for caring this.