Bug 1422931 - Part 1: Fix crash with slot element. r=smaug

2017-12-09 11:24:58 +08:00 · 2017-12-09 11:24:58 +08:00 · b519c97d26
--- a/dom/base/ChildIterator.cpp
+++ b/dom/base/ChildIterator.cpp
@ -66,7 +66,8 @@ ExplicitChildIterator::ExplicitChildIterator(const nsIContent* aParent,
    mIsFirst(aStartAtBeginning),
    mIndexInInserted(0)
 {
-  mParentAsSlot = HTMLSlotElement::FromContent(mParent);
+  mParentAsSlot = nsContentUtils::IsWebComponentsEnabled() ?
+    HTMLSlotElement::FromContent(mParent) : nullptr;
 }

 nsIContent*
--- a/dom/base/crashtests/1422931.html
+++ b/dom/base/crashtests/1422931.html
@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<!-- Testing slot element with "dom.webcomponents.enabled" set to false -->
+<slot><div></div></slot>
+</html>
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@ -236,4 +236,5 @@ load 1406109-1.html
 pref(dom.webcomponents.enabled,true) load 1324463.html
 pref(dom.webcomponents.customelements.enabled,true) load 1413815.html
 load 1411473.html
+pref(dom.webcomponents.enabled,false) load 1422931.html
 pref(dom.webcomponents.enabled,true) load 1419799.html
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@ -7534,7 +7534,7 @@ nsContentUtils::IsContentInsertionPoint(nsIContent* aContent)
 bool
 nsContentUtils::HasDistributedChildren(nsIContent* aContent)
 {
-  if (!aContent) {
+  if (!IsWebComponentsEnabled() || !aContent) {
    return false;
  }