summaryrefslogtreecommitdiffstats
path: root/dom/base
diff options
context:
space:
mode:
Diffstat (limited to 'dom/base')
-rw-r--r--dom/base/crashtests/1419799.html17
-rw-r--r--dom/base/crashtests/crashtests.list1
-rw-r--r--dom/base/nsContentUtils.cpp12
3 files changed, 19 insertions, 11 deletions
diff --git a/dom/base/crashtests/1419799.html b/dom/base/crashtests/1419799.html
new file mode 100644
index 000000000..b6d34a1a9
--- /dev/null
+++ b/dom/base/crashtests/1419799.html
@@ -0,0 +1,17 @@
+<html>
+ <head>
+ <script>
+ try { o1 = document.createElement('textarea') } catch(e) { }
+ try { o2 = document.createElement('div') } catch(e) { }
+ try { o3 = document.createElement('map') } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { }
+ try { o2.appendChild(o1) } catch(e) { }
+ try { document.documentElement.getClientRects() } catch(e) { }
+ try { o4 = o2.attachShadow({ mode: "open" }); } catch(e) { }
+ try { o1.appendChild(o3) } catch(e) { }
+ try { o5 = o3.parentElement } catch(e) { }
+ try { o3.outerHTML = "\n" } catch(e) { }
+ try { o4.prepend("", o5, "") } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index d8b5e9625..8b115fd4d 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -210,3 +210,4 @@ load 1251361.html
load 1304437.html
pref(clipboard.autocopy,true) load 1385272-1.html
pref(dom.webcomponents.customelements.enabled,true) load 1341693.html
+pref(dom.webcomponents.enabled,true) load 1419799.html
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 62be71b4a..502c40977 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -4955,17 +4955,7 @@ nsContentUtils::IsInSameAnonymousTree(const nsINode* aNode,
return aContent->GetBindingParent() == nullptr;
}
- const nsIContent* nodeAsContent = static_cast<const nsIContent*>(aNode);
-
- // For nodes in a shadow tree, it is insufficient to simply compare
- // the binding parent because a node may host multiple ShadowRoots,
- // thus nodes in different shadow tree may have the same binding parent.
- if (aNode->IsInShadowTree()) {
- return nodeAsContent->GetContainingShadow() ==
- aContent->GetContainingShadow();
- }
-
- return nodeAsContent->GetBindingParent() == aContent->GetBindingParent();
+ return aNode->AsContent()->GetBindingParent() == aContent->GetBindingParent();
}
class AnonymousContentDestroyer : public Runnable {