From b519c97d2690fb6ed458e407b0ca7f47b51fb59a Mon Sep 17 00:00:00 2001 From: Jessica Jong Date: Sat, 9 Dec 2017 11:24:58 +0800 Subject: [PATCH] Bug 1422931 - Part 1: Fix crash with slot element. r=smaug --- dom/base/ChildIterator.cpp | 3 ++- dom/base/crashtests/1422931.html | 6 ++++++ dom/base/crashtests/crashtests.list | 1 + dom/base/nsContentUtils.cpp | 2 +- 4 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 dom/base/crashtests/1422931.html diff --git a/dom/base/ChildIterator.cpp b/dom/base/ChildIterator.cpp index 00664d9573fa..6ef0c4e96d59 100644 --- a/dom/base/ChildIterator.cpp +++ b/dom/base/ChildIterator.cpp @@ -66,7 +66,8 @@ ExplicitChildIterator::ExplicitChildIterator(const nsIContent* aParent, mIsFirst(aStartAtBeginning), mIndexInInserted(0) { - mParentAsSlot = HTMLSlotElement::FromContent(mParent); + mParentAsSlot = nsContentUtils::IsWebComponentsEnabled() ? + HTMLSlotElement::FromContent(mParent) : nullptr; } nsIContent* diff --git a/dom/base/crashtests/1422931.html b/dom/base/crashtests/1422931.html new file mode 100644 index 000000000000..9f09f41efdbd --- /dev/null +++ b/dom/base/crashtests/1422931.html @@ -0,0 +1,6 @@ + + + + +
 + diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list index 37b502fd8507..02b02a9c7eb0 100644 --- a/dom/base/crashtests/crashtests.list +++ b/dom/base/crashtests/crashtests.list @@ -236,4 +236,5 @@ load 1406109-1.html pref(dom.webcomponents.enabled,true) load 1324463.html pref(dom.webcomponents.customelements.enabled,true) load 1413815.html load 1411473.html +pref(dom.webcomponents.enabled,false) load 1422931.html pref(dom.webcomponents.enabled,true) load 1419799.html diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 8db11279e86f..37cd08839330 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -7534,7 +7534,7 @@ nsContentUtils::IsContentInsertionPoint(nsIContent* aContent) bool nsContentUtils::HasDistributedChildren(nsIContent* aContent) { - if (!aContent) { + if (!IsWebComponentsEnabled() || !aContent) { return false; }