Bug 1454572: nsComputedDOMStyle: Don't crash when used on a detached pseudo-element. r?:emilio draft
authorJames Teh <jteh@mozilla.com>
Thu, 19 Apr 2018 15:53:25 +1000
changeset 785402 7f273b35920b9b8ceb0eed8d874baf83b7e45c0c
parent 784732 a0c804993efc599a95e97bea39fa1528fd0195d8
push id107219
push userbmo:jteh@mozilla.com
push dateFri, 20 Apr 2018 00:50:18 +0000
bugs1454572
milestone61.0a1
Bug 1454572: nsComputedDOMStyle: Don't crash when used on a detached pseudo-element. r?:emilio This shouldn't normally happen, but it does in some rare cases; e.g. if an accessibility client queries info for a node that is being removed. MozReview-Commit-ID: 3nac9ITN66f
layout/style/nsComputedDOMStyle.cpp
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -496,16 +496,17 @@ GetPseudoType(nsAtom* aPseudo)
 
 already_AddRefed<ComputedStyle>
 nsComputedDOMStyle::DoGetComputedStyleNoFlush(Element* aElement,
                                               nsAtom* aPseudo,
                                               nsIPresShell* aPresShell,
                                               StyleType aStyleType)
 {
   MOZ_ASSERT(aElement, "NULL element");
+
   // If the content has a pres shell, we must use it.  Otherwise we'd
   // potentially mix rule trees by using the wrong pres shell's style
   // set.  Using the pres shell from the content also means that any
   // content that's actually *in* a document will get the style from the
   // correct document.
   nsIPresShell* presShell = nsContentUtils::GetPresShellForContent(aElement);
   bool inDocWithShell = true;
   if (!presShell) {
@@ -516,16 +517,24 @@ nsComputedDOMStyle::DoGetComputedStyleNo
     }
   }
 
   CSSPseudoElementType pseudoType = GetPseudoType(aPseudo);
   if (aPseudo && pseudoType >= CSSPseudoElementType::Count) {
     return nullptr;
   }
 
+  if (aElement->IsInNativeAnonymousSubtree() && !aElement->IsInComposedDoc()) {
+    // Normal web content can't access NAC, but Accessibility, DevTools and
+    // Editor use this same API and this may get called for anonymous content.
+    // Computing the style of a pseudo-element that doesn't have a parent doesn't
+    // really make sense.
+    return nullptr;
+  }
+
   // XXX the !aElement->IsHTMLElement(nsGkAtoms::area)
   // check is needed due to bug 135040 (to avoid using
   // mPrimaryFrame). Remove it once that's fixed.
   if (inDocWithShell &&
       aStyleType == eAll &&
       !aElement->IsHTMLElement(nsGkAtoms::area)) {
     nsIFrame* frame = nullptr;
     if (aPseudo == nsCSSPseudoElements::before) {