Closed
Bug 1459688
Opened 7 years ago
Closed 7 years ago
Shadow DOM can leak the style sheets if there's a cycle created with JS.
Categories
(Core :: DOM: Core & HTML, enhancement, P1)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
FIXED
mozilla62
| Tracking | Status | |
|---|---|---|
| firefox62 | --- | fixed |
People
(Reporter: emilio, Assigned: emilio)
References
Details
Attachments
(1 file)
<!doctype html>
<div id="host"></div>
<script>
host.attachShadow({ mode: "open" }).innerHTML = `<style></style>`;
host.shadowRoot.styleSheets[0].foobie = host.shadowRoot;
</script>
| Comment hidden (mozreview-request) |
|
||
Comment 2•7 years ago
|
||
| mozreview-review | ||
Comment on attachment 8973765 [details]
Bug 1459688: Properly traverse the stylesheet list of the shadow root.
https://reviewboard.mozilla.org/r/242132/#review247958
::: commit-message-56918:7
(Diff revision 1)
> +
> +This is sound because the unlink implementation of the stylesheet drops the
> +preserved wrapper, and there are no strong references back to any node from the
> +stylesheet or any of the non-unlinked members.
> +
> +This is the same setup that works for document sheets. We need to account for a
This is not the same setup, since Document doesn't do the stylo magic. Could you change the comment a bit.
Attachment #8973765 -
Flags: review?(bugs) → review+
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3b491d808696
Properly traverse the stylesheet list of the shadow root. r=smaug
|
||
Updated•7 years ago
|
Priority: -- → P1
|
||
Comment 4•7 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox62:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla62
You need to log in
before you can comment on or make changes to this bug.
Description
•