diff options
| author | Matt A. Tobin <email@mattatobin.com> | 2020-04-17 07:23:48 -0400 |
|---|---|---|
| committer | Matt A. Tobin <email@mattatobin.com> | 2020-04-17 07:23:48 -0400 |
| commit | f0b7ba1e2b49858ce2755c61beebe3694cae882f (patch) | |
| tree | 9e77a30d9d833bcbde854db394148db523450526 | |
| parent | 003e537dcbaa524fcaa5e36a834278a00653bdef (diff) | |
| download | uxp-f0b7ba1e2b49858ce2755c61beebe3694cae882f.tar.gz | |
Bug 1419799 - Fix nsContentUtils::IsInSameAnonymousTree in Shadow DOM
Tag #1375
| -rw-r--r-- | dom/base/crashtests/1419799.html | 17 | ||||
| -rw-r--r-- | dom/base/crashtests/crashtests.list | 1 | ||||
| -rw-r--r-- | dom/base/nsContentUtils.cpp | 12 |
3 files changed, 19 insertions, 11 deletions
diff --git a/dom/base/crashtests/1419799.html b/dom/base/crashtests/1419799.html new file mode 100644 index 0000000000..b6d34a1a97 --- /dev/null +++ b/dom/base/crashtests/1419799.html @@ -0,0 +1,17 @@ +<html> + <head> + <script> + try { o1 = document.createElement('textarea') } catch(e) { } + try { o2 = document.createElement('div') } catch(e) { } + try { o3 = document.createElement('map') } catch(e) { } + try { document.documentElement.appendChild(o2) } catch(e) { } + try { o2.appendChild(o1) } catch(e) { } + try { document.documentElement.getClientRects() } catch(e) { } + try { o4 = o2.attachShadow({ mode: "open" }); } catch(e) { } + try { o1.appendChild(o3) } catch(e) { } + try { o5 = o3.parentElement } catch(e) { } + try { o3.outerHTML = "\n" } catch(e) { } + try { o4.prepend("", o5, "") } catch(e) { } + </script> + </head> +</html> diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list index d8b5e9625a..8b115fd4de 100644 --- a/dom/base/crashtests/crashtests.list +++ b/dom/base/crashtests/crashtests.list @@ -210,3 +210,4 @@ load 1251361.html load 1304437.html pref(clipboard.autocopy,true) load 1385272-1.html pref(dom.webcomponents.customelements.enabled,true) load 1341693.html +pref(dom.webcomponents.enabled,true) load 1419799.html diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 62be71b4ab..502c409778 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -4955,17 +4955,7 @@ nsContentUtils::IsInSameAnonymousTree(const nsINode* aNode, return aContent->GetBindingParent() == nullptr; } - const nsIContent* nodeAsContent = static_cast<const nsIContent*>(aNode); - - // For nodes in a shadow tree, it is insufficient to simply compare - // the binding parent because a node may host multiple ShadowRoots, - // thus nodes in different shadow tree may have the same binding parent. - if (aNode->IsInShadowTree()) { - return nodeAsContent->GetContainingShadow() == - aContent->GetContainingShadow(); - } - - return nodeAsContent->GetBindingParent() == aContent->GetBindingParent(); + return aNode->AsContent()->GetBindingParent() == aContent->GetBindingParent(); } class AnonymousContentDestroyer : public Runnable { |