Bug 325644
| Summary: | moveBefore() leaves <map>, usemap, <label for>, radio group and slot name registrations in the old tree scope | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Anne van Kesteren <annevk> |
| Component: | DOM | Assignee: | Luke Warlow <lwarlow> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | lwarlow, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: | https://github.com/web-platform-tests/wpt/pull/63108 | ||
| Bug Depends on: | 325616 | ||
| Bug Blocks: | 314067 | ||
Anne van Kesteren
HTMLMapElement, HTMLImageElement (usemap), HTMLLabelElement (for), HTMLInputElement (radio groups) and HTMLSlotElement (slot names) update their tree scope in insertionSteps() and removingSteps() when treeScopeChanged is set, but not in
movingSteps(). Element's scoped custom element registry handling in those steps has the same gap. After moveBefore() across a shadow boundary, they all stay registered with the old tree scope.
For <map> this also crashes release builds. Moving a <map> into a shadow root and then hit testing an <img usemap> in the document fails RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(&element->treeScope() == &scope) in TreeScopeOrderedMap::get(),
reached through getElementByMapName():
<!DOCTYPE html>
<img usemap="#m" width="100" height="100" style="display:block" src="data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==">
<map name="m"><area shape="rect" coords="0,0,100,100" href="#a"></map>
<div id="host"></div>
<script>
host.attachShadow({mode: "open"}).moveBefore(document.querySelector("map"), null);
document.elementFromPoint(50, 50);
</script>
Bug 325616 gives the moving steps oldTreeScopeChanged and newTreeScopeChanged, the counterparts of RemovalType's and InsertionType's treeScopeChanged, so each class can reuse its existing removal and insertion code. This is a crashing part of the audit tracked in bug 314066.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Luke Warlow
Pull request: https://github.com/WebKit/WebKit/pull/75397
Luke Warlow
WPT Export PR: https://github.com/web-platform-tests/wpt/pull/63108
Luke Warlow
Slot names will be handled by a separate patch.
EWS
Committed 322482@main (a030dbafac80): <https://commits.webkit.org/322482@main>
Reviewed commits have been landed. Closing PR #75397 and removing active labels.
Radar WebKit Bug Importer
<rdar://problem/188992616>