haikuwebkit/LayoutTests/fast/shadow-dom/composed-tree-iterator-esca...

<div>named slot</div>
<div>default</div>
Specific dom node order of Shadow DOM (re)projection causes crash https://bugs.webkit.org/show_bug.cgi?id=211159 <rdar://problem/62626920> Reviewed by Zalan Bujtas. Source/WebCore: ComposedTreeIterator may traverse to nodes outside its root element if it is constructed with a starting node that has no next sibling inside a slot. This leads to miscomputing RenderTreePosition::nextSibling() and eventual nullptr crash in RenderTreeBuilder when adding a renderer (due to beforeChild renderer being outside the parent renderer). Test case by Elliott Marquez. Test: fast/shadow-dom/composed-tree-iterator-escape.html * dom/ComposedTreeIterator.cpp: (WebCore::ComposedTreeIterator::Context::Context): When findind the end iterator for a tree context we need to look for a sibling in ancestors if the current node has no siblings. LayoutTests: * fast/shadow-dom/composed-tree-iterator-escape-expected.html: Added. * fast/shadow-dom/composed-tree-iterator-escape.html: Added. Canonical link: https://commits.webkit.org/224179@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@260997 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2020-05-01 14:35:12 +00:00			`<div>named slot</div>`
			`<div>default</div>`