Skip to content

GitLab

T
tangled
Commit 8436c831 authored by Rune Lillesveen's avatar Rune Lillesveen Committed by Commit Bot
Browse files
Options

Don't query V0 insertion points for ::selection style. 

Early return to avoid DCHECK and following crash in
StyleForPseudoElement().

Bug: 979573
Change-Id: Ib286ccd62193c6b85b910cd8b127c37189aedd53
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1713532Reviewed-by: default avatarAnders Hartvoll Ruud <andruud@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#679957}
parent b7e09037
Hide whitespace changes
Inline Side-by-side
Showing with 26 additions and 2 deletions
third_party/blink/renderer/core/paint/selection_painting_utils.cc
View file @ 8436c831
...@@ -9,6 +9,7 @@ ...@@ -9,6 +9,7 @@
#include "third_party/blink/renderer/core/dom/element_traversal.h" #include "third_party/blink/renderer/core/dom/element_traversal.h"
#include "third_party/blink/renderer/core/dom/node.h" #include "third_party/blink/renderer/core/dom/node.h"
#include "third_party/blink/renderer/core/dom/shadow_root.h" #include "third_party/blink/renderer/core/dom/shadow_root.h"
#include "third_party/blink/renderer/core/dom/v0_insertion_point.h"
#include "third_party/blink/renderer/core/editing/frame_selection.h" #include "third_party/blink/renderer/core/editing/frame_selection.h"
#include "third_party/blink/renderer/core/frame/local_frame.h" #include "third_party/blink/renderer/core/frame/local_frame.h"
#include "third_party/blink/renderer/core/layout/layout_theme.h" #include "third_party/blink/renderer/core/layout/layout_theme.h"
...@@ -46,10 +47,19 @@ scoped_refptr<ComputedStyle> GetUncachedSelectionStyle(Node* node) { ...@@ -46,10 +47,19 @@ scoped_refptr<ComputedStyle> GetUncachedSelectionStyle(Node* node) {
// If we request ::selection style for LayoutText, query ::selection style on // If we request ::selection style for LayoutText, query ::selection style on
// the parent element instead, as that is the node for which ::selection // the parent element instead, as that is the node for which ::selection
// matches. // matches. This should must likely have used FlatTreeTraversal, but since we
// don't implement inheritance of ::selection styles, it would probably break
// cases where you style a shadow host with ::selection and expect light tree
// text children to be affected by that style.
Element* element = Traversal<Element>::FirstAncestorOrSelf(*node); Element* element = Traversal<Element>::FirstAncestorOrSelf(*node);
if (!element || element->IsPseudoElement())
// <content> and <shadow> elements do not have ComputedStyle, hence they will
// return null for StyleForPseudoElement(). Return early to avoid DCHECK
// failure for GetComputedStyle() inside StyleForPseudoElement() below.
if (!element || element->IsPseudoElement() ||
IsActiveV0InsertionPoint(*element)) {
return nullptr; return nullptr;
}
return element->StyleForPseudoElement(PseudoStyleRequest(kPseudoIdSelection)); return element->StyleForPseudoElement(PseudoStyleRequest(kPseudoIdSelection));
} }
......
third_party/blink/web_tests/fast/dom/shadow/content-text-selection-crash.html 0 → 100644
View file @ 8436c831
<!doctype html>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<p>Selecting all text should not crash.</p>
<div id="host"></div>
<script>
test(() => {
const root = host.createShadowRoot();
root.innerHTML = "<style>content::selection {color:green}</style><content>Fallback</content>";
const range = document.createRange();
range.selectNode(document.body);
window.getSelection().addRange(range);
}, "Adding ::selection style on <content> should not crash when rendering fallback.");
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment