1733182 - [wpt-sync] Sync PR 30842 - Fix DisplayLocking ShadowDOM Range getBoundingClientRect crash

Status: RESOLVED FIXED

(Core :: Layout, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 30842 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/30842
Details from upstream follow.

Joey Arhar <[e-mail]> wrote:

Fix DisplayLocking ShadowDOM Range getBoundingClientRect crash

The traversal I am replacing in this patch is supposed to match the way
that Range traverses the DOM tree, but it doesn't. Range uses
NodeTraversal::Next, but this code was using FlatTreeTraversal::Next.
Due to this, it got in a state where the FlatTreeTraversal would never
get to the end node as specified by the Range, so it would run past the
end of the DOM tree and crash.

This new traversal is much more similar to the Range's traversal, but
also includes all shadow trees just to be safe and make sure we unlock
everything that might need to get unlocked.

Fixed: 1250391
Change-Id: I5107ba768d12beaeb440a73389ec90d3e8748feb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3167936
Reviewed-by: Mason Freed \<[e-mail]>
Reviewed-by: vmpstr \<[e-mail]>
Commit-Queue: Joey Arhar \<[e-mail]>
Cr-Commit-Position: refs/heads/main@{#925413}

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=3d57cc8c7a409798c1d69e37124472410638c683

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 11 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests

Status Summary

Firefox

PASS : 1

Chrome

CRASH: 1

Safari

PASS : 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7f73647f6228
[wpt PR 30842] - Fix DisplayLocking ShadowDOM Range getBoundingClientRect crash, a=testonly

Comment 4

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/7f73647f6228