haikuwebkit/LayoutTests/fast/dom/add-document-child-and-repa...

15 lines
631 B
HTML
Raw Permalink Normal View History

Source/WebCore: Fix null pointer crash in RenderBox::styleDidChange https://bugs.webkit.org/show_bug.cgi?id=208311 Patch by Eugene But <eugenebut@chromium.org> on 2020-03-27 Reviewed by Ryosuke Niwa. RenderBox::styleDidChange crashes when changing style for HTMLBodyElement element. Crash happens on dereferencing null document().documentElement()->renderer() pointer: if (.... || !documentElementRenderer->style().hasExplicitlySetWritingMode())) { That HTMLBodyElement was added as the second child of document, which is not allowed per spec: If parent is a document, and any of the statements below, switched on node, are true, then throw a "HierarchyRequestError" DOMException: ....... element parent has an element child that is not child or a doctype is following child. ...... https://dom.spec.whatwg.org/#concept-node-replace This patch prevents adding HTMLBodyElement as the second child by running more strict checks inside WebCore::Document::canAcceptChild(). Previously canAcceptChild() would allow all Replace operations if new child had the same type as old child, even if old child has changed the parent. If old child has changed the parent (parent is not document), it means that child was removed from document and it is possible that mutation event handler has already added a new child to document. This is normal situation, but it means that canAcceptChild() can not short circuit only on comparing the types of old and new child, and has to run all checks listed in https://dom.spec.whatwg.org/#concept-node-replace Tests: fast/dom/add-document-child-during-document-child-replacement.html fast/dom/add-document-child-and-reparent-old-child-during-document-child-replacement.html * Source/WebCore/dom/Document.cpp: (WebCore::Document::canAcceptChild): LayoutTests: Test for RenderBox::styleDidChange crash fix https://bugs.webkit.org/show_bug.cgi?id=208311 Patch by Eugene But <eugenebut@chromium.org> on 2020-03-27 Reviewed by Ryosuke Niwa add-document-child-during-document-child-replacement.html test adds svg child to a document from mutation event observer while existing document child is being replaced. After adding svg child, the document should reject the replacement of existing child, per spec: If parent is a document, and any of the statements below, switched on node, are true, then throw a "HierarchyRequestError" DOMException: ....... element parent has an element child that is not child or a doctype is following child. ...... https://dom.spec.whatwg.org/#concept-node-replace add-document-child-and-reparent-old-child-during-document-child-replacement.html reparents the old child to create slightly different state where old child still has a parent but that parent is not document. * add-document-child-during-document-child-replacement.html: * add-document-child-and-reparent-old-child-during-document-child-replacement.html: Canonical link: https://commits.webkit.org/222617@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@259152 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-03-28 04:00:36 +00:00
<body dir="rtl"></body>
<script src="../../resources/js-test-pre.js"></script>
<script>
let documentDocumentElement = document.documentElement;
document.body.offsetHeight;
document.addEventListener("DOMSubtreeModified", function() {
document.execCommand("SelectAll");
let svg = document.createElementNS("http://www.w3.org/2000/svg", "desc");
document.appendChild(svg);
document.createElement('div').appendChild(documentDocumentElement);
});
shouldThrowErrorName("document.replaceChild(document.body, document.documentElement)", "HierarchyRequestError");
</script>