haikuwebkit/LayoutTests/fast/shadow-dom/shadow-slot-attribute-chang...

27 lines
815 B
HTML
Raw Permalink Normal View History

Crash in render tree after dynamically mutating the slot value https://bugs.webkit.org/show_bug.cgi?id=167502 Patch by Ryosuke Niwa <rniwa@webkit.org> on 2017-02-09 Reviewed by Antti Koivisto. Source/WebCore: The crash was caused by attributeChanged not destructing the render tree after an assigned element had been removed from its slot. Since the style resolver can no longer find this element in the flat tree, we need to delete its render object as if the element had been removed from the DOM tree. Tests: fast/html/details-summary-slot.html fast/shadow-dom/shadow-slot-attribute-change-crash.html * dom/Element.cpp: (WebCore::Element::attributeChanged): * html/HTMLSummaryElement.cpp: (WebCore::SummarySlotElement): Added. Always use the default slot regardless of the slot attribute's value. (WebCore::HTMLSummaryElement::create): Use SummarySlotElement LayoutTests: Added regression tests for the crash, and one for assigning non-empty slot value to a child of a summary element. The slot attribute should always be ignored since the fact summary element has its own shadow tree is an implementation detail that should never be exposed. * fast/html/details-summary-slot-expected.html: Added. * fast/html/details-summary-slot.html: Added. * fast/shadow-dom/shadow-slot-attribute-change-crash-expected.txt: Added. * fast/shadow-dom/shadow-slot-attribute-change-crash.html: Added. Canonical link: https://commits.webkit.org/185135@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@212028 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2017-02-10 02:19:04 +00:00
<!DOCTYPE html>
<html>
<body>
<p>This tests dynamically mutating the slot value. WebKit should not crash.</p>
<outer-host style="display: block; -webkit-column-count: 2;"><inner-host style="display: block;"><div id="mutateThis">?<section style="column-span: all;"></section></div></inner-host></outer-host>
<script>
if (window.testRunner)
testRunner.dumpAsText();
let outerHost = document.querySelector('outer-host');
outerHost.attachShadow({mode: 'closed'}).innerHTML = '<slot></slot>';
let innerHost = document.querySelector('inner-host').attachShadow({mode: 'closed'});
innerHost.innerHTML = '<slot></slot>';
outerHost.getBoundingClientRect();
mutateThis.slot = "f";
outerHost.getBoundingClientRect();
mutateThis.innerText = "";
document.write('PASS - WebKit did not crash');
</script>
</body>
</html>