Bug 1324463. Fix crash when xbl:children is stuck into shadow DOM. r=smaug

MozReview-Commit-ID: C602pPbIfih
2017-10-11 22:19:10 -04:00 · 2017-10-11 22:19:10 -04:00 · fb61ca8219
--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@ -508,7 +508,7 @@ ShadowRoot::ContentAppended(nsIDocument* aDocument,
    // Add insertion point to destination insertion points of fallback content.
    if (nsContentUtils::IsContentInsertionPoint(aContainer)) {
      HTMLContentElement* content = HTMLContentElement::FromContent(aContainer);
-      if (content->MatchedNodes().IsEmpty()) {
+      if (content && content->MatchedNodes().IsEmpty()) {
        currentChild->DestInsertionPoints().AppendElement(aContainer);
      }
    }
--- a/dom/base/crashtests/1324463.html
+++ b/dom/base/crashtests/1324463.html
@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<script>
+// requires: user_pref("dom.webcomponents.enabled", true);
+addEventListener("DOMContentLoaded", function(){
+  let o_0 = document.createElement("span").createShadowRoot();
+  let o_1 = document.createElementNS("http://www.mozilla.org/xbl", "binding");
+  let o_2 = document.createElementNS("http://www.mozilla.org/xbl", "children");
+  let o_3 = document.createTextNode("");
+  o_0.appendChild(o_1);
+  o_1.appendChild(o_2);
+  o_2.appendChild(o_3);
+  o_2.removeChild(o_3);
+});
+</script>
+</html>
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@ -231,3 +231,4 @@ load 1400701.html
 load 1403377.html
 load 1405771.html
 load 1406109-1.html
+pref(dom.webcomponents.enabled,true) load 1324463.html