fix: diff fragment vulnerability

Author: yuche

packages/nerv/src/lifecycle.ts

@@ -186,7 +186,7 @@ function getFragmentHostNode (children: VNode[]): Node | null {
   } else if (isComposite(child) && child.dom == null) {
     return getFragmentHostNode(child.component._rendered)
   }
-  return child.dom
+  return child != null ? child.dom : null
 }
 
 export function reRenderComponent (
@@ -274,7 +274,7 @@ export function updateComponent (component, isForce = false) {
     let parentDom = lastRendered.dom && lastRendered.dom.parentNode
     if (isArray(lastRendered)) {
       const hostNode = getFragmentHostNode(lastRendered)
-      if (hostNode) {
+      if (hostNode != null) {
         parentDom = (lastRendered as any).dom = hostNode.parentNode
       }
     }

packages/nerv/src/vdom/patch.ts

@@ -88,7 +88,11 @@ export function patch (
         parentNode.removeChild(lastDom[i])
       }
     } else if (parentNode !== null) {
-      parentNode.replaceChild(newDom, lastDom)
+      if (lastDom != null) {
+        parentNode.replaceChild(newDom, lastDom)
+      } else {
+        parentNode.appendChild(newDom)
+      }
     }
   }
   return newDom