From 1c2dd6aee0228dd95ad3495ae6c6a2afdf76a5ae Mon Sep 17 00:00:00 2001 From: FranklinDM Date: Sun, 21 May 2023 15:17:29 +0800 Subject: [PATCH 1/4] Issue #2250 - Part 1: Return early if the element being tested for is likely an ancestor and does not have an assigned slot --- layout/style/nsCSSRuleProcessor.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp index f19aa572c0..1ecf80bc52 100644 --- a/layout/style/nsCSSRuleProcessor.cpp +++ b/layout/style/nsCSSRuleProcessor.cpp @@ -1732,7 +1732,13 @@ static bool SelectorMatches(Element* aElement, Element* targetElement = aElement; if (aTreeMatchContext.mForAssignedSlot) { - targetElement = aElement->GetAssignedSlot()->AsElement(); + HTMLSlotElement* slot = aElement->GetAssignedSlot(); + // We're likely testing the slottable's ancestors and it might + // not have an assigned slot, so return early. + if (!slot) { + return false; + } + targetElement = slot->AsElement(); } // namespace/tag match From 3d917c996527c69b8cf06461cbe6402976571f29 Mon Sep 17 00:00:00 2001 From: FranklinDM Date: Sun, 21 May 2023 15:24:31 +0800 Subject: [PATCH 2/4] Issue #2250 - Part 2: Ignore the ancestor filter assertion if rule matching is restricted or if the current element is under a shadow host This only affects debug builds. --- layout/style/nsCSSRuleProcessor.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp index 1ecf80bc52..ff3661c73d 100644 --- a/layout/style/nsCSSRuleProcessor.cpp +++ b/layout/style/nsCSSRuleProcessor.cpp @@ -680,7 +680,11 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso aData->mTreeMatchContext.mAncestorFilter.HasFilter() ? &aData->mTreeMatchContext.mAncestorFilter : nullptr; #ifdef DEBUG - if (filter) { + bool isRestricted = (aData->mTreeMatchContext.mShadowHosts.Length() > 0 || + aData->mTreeMatchContext.mRestrictToSlottedPseudo || + aData->mTreeMatchContext.mOnlyMatchHostPseudo || + aData->mTreeMatchContext.mForAssignedSlot); + if (filter && !isRestricted) { filter->AssertHasAllAncestors(aElement); } #endif From adaf6c3221f2f0aed84fe2526a21e0aba2fdcf34 Mon Sep 17 00:00:00 2001 From: FranklinDM Date: Sun, 21 May 2023 19:00:13 +0800 Subject: [PATCH 3/4] Issue #1592 - Follow-up: Ensure topmost scope marker is cleaned up --- dom/xbl/nsBindingManager.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dom/xbl/nsBindingManager.cpp b/dom/xbl/nsBindingManager.cpp index b50c86c002..5245821776 100644 --- a/dom/xbl/nsBindingManager.cpp +++ b/dom/xbl/nsBindingManager.cpp @@ -717,8 +717,9 @@ nsBindingManager::WalkRules(nsIStyleRuleProcessor::EnumFunc aFunc, aData->mTreeMatchContext.mIsTopmostScope = (index == 0); binding->WalkRules(aFunc, aData); } - aData->mTreeMatchContext.mForAssignedSlot = false; + aData->mTreeMatchContext.mForAssignedSlot = false; + aData->mTreeMatchContext.mIsTopmostScope = false; aData->mTreeMatchContext.mRestrictToSlottedPseudo = false; } From 106de86dc4ec751a6715cd8685b990aeb359f4d0 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Sun, 21 May 2023 07:55:37 -0500 Subject: [PATCH 4/4] Issue #2252 - Prevent crash when attempting to load a script with execution disallowed. This issue is due to the ExecutionContext added in Issue #1691 not handling GetScript() in a context where script execution is not allowed. This expressed itself in crashes when playing MP4s with the NoScript extension installed and enabled. --- dom/script/ScriptLoader.cpp | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp index 77bfd2024d..89a74c1541 100644 --- a/dom/script/ScriptLoader.cpp +++ b/dom/script/ScriptLoader.cpp @@ -2363,11 +2363,14 @@ ScriptLoader::EvaluateScript(ScriptLoadRequest* aRequest) JS::Rooted script(cx); script = exec.GetScript(); - // Create a ClassicScript object and associate it with the - // JSScript. - RefPtr classicScript = new ClassicScript( - aRequest->mFetchOptions, aRequest->mBaseURL); - classicScript->AssociateWithScript(script); + // With scripts disabled GetScript() will return nullptr + if (script) { + // Create a ClassicScript object and associate it with the + // JSScript. + RefPtr classicScript = new ClassicScript( + aRequest->mFetchOptions, aRequest->mBaseURL); + classicScript->AssociateWithScript(script); + } rv = exec.ExecScript(); }