[Webkit-unassigned] [Bug 204332] Nullptr crash in Node::setTextContent via Document::setTitle if title element is removed before setTextContent call.

Mon Nov 18 17:32:58 PST 2019

https://bugs.webkit.org/show_bug.cgi?id=204332

--- Comment #6 from Ryosuke Niwa <rniwa at webkit.org> ---
Comment on attachment 383816
  --> https://bugs.webkit.org/attachment.cgi?id=383816
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=383816&action=review

> Source/WebCore/dom/Document.cpp:1601
> +        // Another null check since insertBefore may have triggered event that deletes m_titleElement

This is a bit verbose. I think we can just say: "insertBefore above may have ran scripts which removed m_titleElement"

> Source/WebCore/dom/Document.cpp:1613
> +        // Another null check since appendChild may have triggered event that deletes m_titleElement
> +        if (m_titleElement)

Ditto.

> LayoutTests/fast/dom/Document/title-property-set-with-dom-event.html:1
> +<html>

Can we add another test case with a SVG document since you're also making the code change to SVG code path?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191119/503c412f/attachment.htm>