commit 909e8ef08654d7cfa49b3214029e15dedc5b970b
author jer.noble@apple.com <jer.noble@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Apr 01 17:02:21 2020 +0000
committer jer.noble@apple.com <jer.noble@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Apr 01 17:02:21 2020 +0000
tree dc71285a9377ae5b917af61a6e8c1f4b04517ee6
parent 19b7723e61be67d2290de364785cc8bcb8d9b118

Don't use raw pointers in ShadowRoot.
https://bugs.webkit.org/show_bug.cgi?id=209843
<rdar://problem/61069603>

Reviewed by Brent Fulgham.

* dom/Element.cpp:
(WebCore::Element::addShadowRoot):
* dom/ShadowRoot.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259353 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index d8735a8..5180137 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2020-04-01  Jer Noble  <jer.noble@apple.com>
+
+        Don't use raw pointers in ShadowRoot.
+        https://bugs.webkit.org/show_bug.cgi?id=209843
+        <rdar://problem/61069603>
+
+        Reviewed by Brent Fulgham.
+
+        * dom/Element.cpp:
+        (WebCore::Element::addShadowRoot):
+        * dom/ShadowRoot.h:
+
 2020-04-01  Jack Lee  <shihchieh_lee@apple.com>
 
         Notify accessibility when a node is removed from its ancestor.

Source/WebCore/dom/Element.cpp

diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 60bfc71..6002c3d 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -2291,7 +2291,7 @@
 
         ensureElementRareData().setShadowRoot(WTFMove(newShadowRoot));
 
-        shadowRoot.setHost(this);
+        shadowRoot.setHost(makeWeakPtr<Element>(this));
         shadowRoot.setParentTreeScope(treeScope());
 
 #if ASSERT_ENABLED

Source/WebCore/dom/ShadowRoot.h

diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index dbe16a7..b0c9dc1 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -71,8 +71,8 @@
     bool containsFocusedElement() const { return m_containsFocusedElement; }
     void setContainsFocusedElement(bool flag) { m_containsFocusedElement = flag; }
 
-    Element* host() const { return m_host; }
-    void setHost(Element* host) { m_host = host; }
+    Element* host() const { return m_host.get(); }
+    void setHost(WeakPtr<Element>&& host) { m_host = WTFMove(host); }
 
     String innerHTML() const;
     ExceptionOr<void> setInnerHTML(const String&);
@@ -130,7 +130,7 @@
     bool m_containsFocusedElement { false };
     ShadowRootMode m_type { ShadowRootMode::UserAgent };
 
-    Element* m_host { nullptr };
+    WeakPtr<Element> m_host;
     RefPtr<StyleSheetList> m_styleSheetList;
 
     std::unique_ptr<Style::Scope> m_styleScope;