Bug 1404180 - Don't allow associating form elements by ID to <form>s across anonymous subtree boundaries. r?smaug
MozReview-Commit-ID: KRJjrkL4FgZ
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@@ -2314,17 +2314,19 @@ nsGenericHTMLFormElement::UpdateFormOwne
NS_ASSERTION(GetUncomposedDoc(), "The element should be in a document "
"when UpdateFormOwner is called!");
NS_ASSERTION(!GetUncomposedDoc() ||
element == GetUncomposedDoc()->GetElementById(formId),
"element should be equals to the current element "
"associated with the id in @form!");
- if (element && element->IsHTMLElement(nsGkAtoms::form)) {
+ if (element &&
+ element->IsHTMLElement(nsGkAtoms::form) &&
+ nsContentUtils::IsInSameAnonymousTree(this, element)) {
SetForm(static_cast<HTMLFormElement*>(element), aBindToTree);
}
}
} else {
// We now have a parent, so we may have picked up an ancestor form. Search
// for it. Note that if mForm is already set we don't want to do this,
// because that means someone (probably the content sink) has already set
// it to the right value. Also note that even if being bound here didn't
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1404180-1.html
@@ -0,0 +1,22 @@
+<script>
+function jsfuzzer() {
+ try { htmlvar00016.appendChild(htmlvar00017); } catch(e) { }
+ try { htmlvar00016.form.setAttribute("novalidate", "novalidate"); } catch(e) { }
+ try { htmlvar00017.appendChild(htmlvar00036); } catch(e) { }
+ try { svgvar00007.appendChild(htmlvar00008); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<form id="htmlvar00007">
+<legend id="htmlvar00008">
+<output id="htmlvar00016"></output>
+</legend>
+<link id="htmlvar00017"></link>
+<svg>
+<path id="svgvar00006">
+<animateTransform id="svgvar00007"/>
+</path>
+<use xlink:href="#svgvar00006">
+<table id="htmlvar00036">
+<th>
+<output form="htmlvar00007">
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -234,8 +234,9 @@ load 1402366.html
load 1402419.html
load 1402472.html
load 1403028.html
load 1403433.html
load 1403465.html
load 1403592.html
load 1403615.html
load 1403712.html
+load 1404180-1.html
