Bug 211159

Summary: Specific dom node order of Shadow DOM (re)projection causes crash
Product: WebKit Reporter: Elliott Marquez <emarquez>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, dfreedm, esprehn+autocc, ews-watchlist, florian, kangil.han, koivisto, rniwa, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: Safari 13   
Hardware: Mac   
OS: macOS 10.15   
Attachments:
Description Flags
Reproduction of failure
none
patch none

Description Elliott Marquez 2020-04-28 17:55:53 PDT 
Created attachment 397914 [details]
Reproduction of failure

Hello, there seems to be some mix of issues projecting a <slot>'s default content into a shadow root that has both a named and nameless slot. I have attached a reproduction case and here is a JSbin for a live example:

https://jsbin.com/qicoganici/1/edit

Some quirks I've found:

Removing the named slot:

<div>
  <slot></slot>
</div>


moving it into the same div as the nameless slot:

<div>
  <slot name="named"></slot>
  <slot></slot>
</div>


or moving it after the nameless slot:

<div>
  <slot></slot>
</div>
<slot name="named"></slot>


seems to prevent this crash. Additionally, removing the default content (the text node "default" in this example):

<my-element-inner>
  <slot></slot>
  <div slot="named">named slot<div>
</my-element-inner>


wrapping the slot in the outer element with a span or div:

<my-element-inner>
  <span><slot>default</slot></span>
  <div slot="named">named slot<div>
</my-element-inner>


or actually projecting a value into the outer element:

<my-element-outer>projected</my-element-outer>


also seems to prevent this crash as well. Notably, simply wrapping the named slot in an element:

<div>
  <slot name="named"></slot>
</div>
<div>
  <slot></slot>
</div>

does not prevent this crash. Confirm this crash on Safari 13.1 (WK: 156609.1.20.111.8) and 13.2 (WK: 15610.1.10)
Comment 1 Alexey Proskuryakov 2020-04-29 17:57:52 PDT 
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00007fff40c872a3 WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation(WebCore::RenderBlock&, std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) + 67
1   com.apple.WebCore             	0x00007fff40c86f56 WebCore::RenderTreeBuilder::Block::attach(WebCore::RenderBlock&, std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) + 86
2   com.apple.WebCore             	0x00007fff40c8ae4a WebCore::RenderTreeBuilder::BlockFlow::attach(WebCore::RenderBlockFlow&, std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) + 298
3   com.apple.WebCore             	0x00007fff40c86d7b WebCore::RenderTreeBuilder::attach(WebCore::RenderElement&, std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) + 1739
4   com.apple.WebCore             	0x00007fff40c96d08 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) + 5912
5   com.apple.WebCore             	0x00007fff4024f89c WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 1468
6   com.apple.WebCore             	0x00007fff3ef6d044 WebCore::Document::updateStyleIfNeeded() + 468
7   com.apple.WebCore             	0x00007fff3ef6cb0b WebCore::Document::finishedParsing() + 539
8   com.apple.WebCore             	0x00007fff3ef641b4 WebCore::HTMLDocumentParser::prepareToStopParsing() + 196
9   com.apple.WebCore             	0x00007fff3ef63ed4 WebCore::HTMLDocumentParser::finish() + 388
10  com.apple.WebCore             	0x00007fff406eff21 WebCore::DocumentLoader::finishedLoading() + 545
11  com.apple.WebCore             	0x00007fff3efce24c WebCore::CachedResource::checkNotify() + 92
12  com.apple.WebCore             	0x00007fff4077d099 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 1241
Comment 2 Radar WebKit Bug Importer 2020-04-29 17:58:04 PDT 
<rdar://problem/62626920>
Comment 3 Antti Koivisto 2020-05-01 06:26:18 PDT 
Created attachment 398176 [details]
patch
Comment 4 EWS 2020-05-01 07:35:16 PDT 
Committed r260997: <https://trac.webkit.org/changeset/260997>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 398176 [details].