Title: [252667] trunk
Revision
252667
Author
commit-qu...@webkit.org
Date
2019-11-19 17:27:35 -0800 (Tue, 19 Nov 2019)

Log Message

Nullptr crash in Node::setTextContent via Document::setTitle if title element is removed before setTextContent call.
https://bugs.webkit.org/show_bug.cgi?id=204332

Patch by Sunny He <sunny...@apple.com> on 2019-11-19
Reviewed by Ryosuke Niwa.

Source/WebCore:

Test: fast/dom/Document/title-property-set-with-dom-event.html

* dom/Document.cpp:
(WebCore::Document::setTitle):

LayoutTests:

* fast/dom/Document/title-property-set-with-dom-event-expected.txt: Added.
* fast/dom/Document/title-property-set-with-dom-event.html: Added.
* fast/dom/Document/title-property-set-with-dom-event-svg-expected.html: Added.
* fast/dom/Document/title-property-set-with-dom-event-svg.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (252666 => 252667)


--- trunk/LayoutTests/ChangeLog	2019-11-20 01:24:53 UTC (rev 252666)
+++ trunk/LayoutTests/ChangeLog	2019-11-20 01:27:35 UTC (rev 252667)
@@ -1,3 +1,14 @@
+2019-11-19  Sunny He  <sunny...@apple.com>
+
+        Nullptr crash in Node::setTextContent via Document::setTitle if title element is removed before setTextContent call.
+        https://bugs.webkit.org/show_bug.cgi?id=204332
+
+        Reviewed by Ryosuke Niwa.
+
+        * fast/dom/Document/title-property-set-with-dom-event-expected.txt: Added.
+        * fast/dom/Document/title-property-set-with-dom-event.html: Added.
+        * fast/dom/Document/title-property-set-with-dom-event-svg-expected.html: Added.
+        * fast/dom/Document/title-property-set-with-dom-event-svg.html: Added.
 2019-11-19  Jiewen Tan  <jiewen_...@apple.com>
 
         Unreviewed, test gardening

Added: trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-expected.txt (0 => 252667)


--- trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-expected.txt	2019-11-20 01:27:35 UTC (rev 252667)
@@ -0,0 +1 @@
+Test that setting title while there is a registred DOMNodeInserted event handler which indirectly deletes title doesn't crash.

Added: trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-svg-expected.txt (0 => 252667)


--- trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-svg-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-svg-expected.txt	2019-11-20 01:27:35 UTC (rev 252667)
@@ -0,0 +1 @@
+Test that setting title of a SVG document while there is a registred DOMNodeInserted event handler which indirectly deletes title doesn't crash.

Added: trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-svg.html (0 => 252667)


--- trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-svg.html	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event-svg.html	2019-11-20 01:27:35 UTC (rev 252667)
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+function test() {
+    if (window.testRunner) {
+        window.testRunner.dumpAsText();
+    }
+    var SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+    var svgDocument = document.implementation.createDocument(SVG_NAMESPACE, "svg", null);
+
+    svgDocument.addEventListener("DOMNodeInserted", () => {
+        var a = svgDocument.querySelector("title").remove();
+    });
+    svgDocument.title = "abc"
+}
+test()
+</script>
+</head>
+<body>
+    <p>Test that setting title of a SVG document while there is a registred DOMNodeInserted event handler which indirectly deletes title doesn't crash.
+    </p>
+</body>
+</html>
\ No newline at end of file

Added: trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event.html (0 => 252667)


--- trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event.html	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/Document/title-property-set-with-dom-event.html	2019-11-20 01:27:35 UTC (rev 252667)
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+function test() {
+    if (window.testRunner) {
+        window.testRunner.dumpAsText();
+    }
+
+    window.top.addEventListener("DOMNodeInserted", () => {
+        document.head.innerHTML = 123;
+    }, {once : true});
+    document.title = "abc";
+}
+test()
+</script>
+</head>
+<body>
+    <p>Test that setting title while there is a registred DOMNodeInserted event handler which indirectly deletes title doesn't crash.
+    </p>
+</body>
+</html>
\ No newline at end of file

Modified: trunk/Source/WebCore/ChangeLog (252666 => 252667)


--- trunk/Source/WebCore/ChangeLog	2019-11-20 01:24:53 UTC (rev 252666)
+++ trunk/Source/WebCore/ChangeLog	2019-11-20 01:27:35 UTC (rev 252667)
@@ -1,3 +1,15 @@
+2019-11-19  Sunny He  <sunny...@apple.com>
+
+        Nullptr crash in Node::setTextContent via Document::setTitle if title element is removed before setTextContent call.
+        https://bugs.webkit.org/show_bug.cgi?id=204332
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/dom/Document/title-property-set-with-dom-event.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setTitle):
+
 2019-11-19  Youenn Fablet  <you...@apple.com>
 
         Introduce a mock implementation of CoreAudioSharedUnit

Modified: trunk/Source/WebCore/dom/Document.cpp (252666 => 252667)


--- trunk/Source/WebCore/dom/Document.cpp	2019-11-20 01:24:53 UTC (rev 252666)
+++ trunk/Source/WebCore/dom/Document.cpp	2019-11-20 01:27:35 UTC (rev 252667)
@@ -1609,7 +1609,9 @@
             m_titleElement = SVGTitleElement::create(SVGNames::titleTag, *this);
             element->insertBefore(*m_titleElement, element->firstChild());
         }
-        m_titleElement->setTextContent(title);
+        // insertBefore above may have ran scripts which removed m_titleElement
+        if (m_titleElement)
+            m_titleElement->setTextContent(title);
     } else if (is<HTMLElement>(element)) {
         if (!m_titleElement) {
             auto* headElement = head();
@@ -1618,7 +1620,9 @@
             m_titleElement = HTMLTitleElement::create(HTMLNames::titleTag, *this);
             headElement->appendChild(*m_titleElement);
         }
-        m_titleElement->setTextContent(title);
+        // appendChild above may have ran scripts which removed m_titleElement
+        if (m_titleElement)
+            m_titleElement->setTextContent(title);
     }
 }
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to