Bug 1422931 - Part 1: Fix crash with slot element. r=smaug

dothq · Dec 8, 2017 · 491af03 · 491af03
1 parent ba42dac
commit 491af03
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 2 deletions.
diff --git a/dom/base/ChildIterator.cpp b/dom/base/ChildIterator.cpp
@@ -66,7 +66,8 @@ ExplicitChildIterator::ExplicitChildIterator(const nsIContent* aParent,
     mIsFirst(aStartAtBeginning),
     mIndexInInserted(0)
 {
-  mParentAsSlot = HTMLSlotElement::FromContent(mParent);
+  mParentAsSlot = nsContentUtils::IsWebComponentsEnabled() ?
+    HTMLSlotElement::FromContent(mParent) : nullptr;
 }
 
 nsIContent*

diff --git a/dom/base/crashtests/1422931.html b/dom/base/crashtests/1422931.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<!-- Testing slot element with "dom.webcomponents.enabled" set to false -->
+<slot><div></div></slot>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
@@ -236,4 +236,5 @@ load 1406109-1.html
 pref(dom.webcomponents.enabled,true) load 1324463.html
 pref(dom.webcomponents.customelements.enabled,true) load 1413815.html
 load 1411473.html
+pref(dom.webcomponents.enabled,false) load 1422931.html
 pref(dom.webcomponents.enabled,true) load 1419799.html
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
@@ -7534,7 +7534,7 @@ nsContentUtils::IsContentInsertionPoint(nsIContent* aContent)
 bool
 nsContentUtils::HasDistributedChildren(nsIContent* aContent)
 {
-  if (!aContent) {
+  if (!IsWebComponentsEnabled() || !aContent) {
     return false;
   }