From 206dcff080ab6f3f2d925f34bd8f7c4924366395 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20W=C3=BClker?= Date: Wed, 24 Sep 2025 01:00:11 +0200 Subject: [PATCH] Assert that style element has an owner in `parse_own_css` (#39458) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The existing `assert!(node.is_connected())` is wrong. What it *wants* to assert is that the style element has an owner, which is either a Document or a ShadowRoot that the element is a descendant of. However, if the element is descendant of a ShadowRoot which is itself not connected to a document then the assertion would fail. Instead, we use `node.is_in_a_document_tree() || node.is_in_a_shadow_tree()`, which more accurately reflects the intent. Testing: This change adds the test case from https://github.com/servo/servo/issues/37781 as a crashtest Fixes https://github.com/servo/servo/issues/39457 Fixes https://github.com/servo/servo/issues/37781 --------- Signed-off-by: Simon Wülker --- components/script/dom/html/htmlstyleelement.rs | 5 ++++- tests/wpt/meta/MANIFEST.json | 7 +++++++ ...yle-element-in-disconnected-shadow-crash.html | 16 ++++++++++++++++ 3 files changed, 27 insertions(+), 1 deletion(-) create mode 100644 tests/wpt/tests/shadow-dom/crashtests/modify-style-element-in-disconnected-shadow-crash.html diff --git a/components/script/dom/html/htmlstyleelement.rs b/components/script/dom/html/htmlstyleelement.rs index dbc0bafef81..7e2659b4460 100644 --- a/components/script/dom/html/htmlstyleelement.rs +++ b/components/script/dom/html/htmlstyleelement.rs @@ -97,7 +97,10 @@ impl HTMLStyleElement { pub(crate) fn parse_own_css(&self) { let node = self.upcast::(); - assert!(node.is_connected()); + assert!( + node.is_in_a_document_tree() || node.is_in_a_shadow_tree(), + "This stylesheet does not have an owner, so there's no reason to parse its contents" + ); // Step 4. of let mut type_attribute = self.Type(); diff --git a/tests/wpt/meta/MANIFEST.json b/tests/wpt/meta/MANIFEST.json index 4f24ac911ef..334f4296c54 100644 --- a/tests/wpt/meta/MANIFEST.json +++ b/tests/wpt/meta/MANIFEST.json @@ -10380,6 +10380,13 @@ {} ] ], + "modify-style-element-in-disconnected-shadow-crash.html": [ + "3808642a97451eef40573214fbe1d1c6273c557f", + [ + null, + {} + ] + ], "move-to-new-tree-1343016.html": [ "853884b99301e22383e0fd0936cf154beab5e93e", [ diff --git a/tests/wpt/tests/shadow-dom/crashtests/modify-style-element-in-disconnected-shadow-crash.html b/tests/wpt/tests/shadow-dom/crashtests/modify-style-element-in-disconnected-shadow-crash.html new file mode 100644 index 00000000000..3808642a974 --- /dev/null +++ b/tests/wpt/tests/shadow-dom/crashtests/modify-style-element-in-disconnected-shadow-crash.html @@ -0,0 +1,16 @@ + + + + Modifying a style element in a disconnected shadow tree should not crash + + + + + +