Title: [118471] trunk
- Revision
- 118471
- Author
- [email protected]
- Date
- 2012-05-24 21:38:30 -0700 (Thu, 24 May 2012)
Log Message
Fix crashes caused by a DOMCharacterDataModified event on a text node.
https://bugs.webkit.org/show_bug.cgi?id=86953
Reviewed by Dimitri Glazkov.
Source/WebCore:
TextNode can be released while CharacterData::setData() will dispatch a mutation event.
So protect it.
Mutation event itself should not be dispatched on the test case.
This is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372.
Test: fast/events/dom-character-data-modified-textarea-crash.html
* dom/CharacterData.cpp:
(WebCore::CharacterData::setData):
LayoutTests:
* fast/events/dom-character-data-modified-textarea-crash-expected.txt: Added.
* fast/events/dom-character-data-modified-textarea-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (118470 => 118471)
--- trunk/LayoutTests/ChangeLog 2012-05-25 04:00:42 UTC (rev 118470)
+++ trunk/LayoutTests/ChangeLog 2012-05-25 04:38:30 UTC (rev 118471)
@@ -1,3 +1,13 @@
+2012-05-24 Hayato Ito <[email protected]>
+
+ Fix crashes caused by a DOMCharacterDataModified event on a text node.
+ https://bugs.webkit.org/show_bug.cgi?id=86953
+
+ Reviewed by Dimitri Glazkov.
+
+ * fast/events/dom-character-data-modified-textarea-crash-expected.txt: Added.
+ * fast/events/dom-character-data-modified-textarea-crash.html: Added.
+
2012-05-24 Philippe Normand <[email protected]>
Unreviewed, GTK rebaselines after r118448 and r118353.
Added: trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash-expected.txt (0 => 118471)
--- trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash-expected.txt 2012-05-25 04:38:30 UTC (rev 118471)
@@ -0,0 +1 @@
+Test passes if a DOMCharacterModified event on the textarea does not crash.
Added: trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html (0 => 118471)
--- trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html (rev 0)
+++ trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-05-25 04:38:30 UTC (rev 118471)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+// This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
+// If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
+// For example, if we move this comment to the actual HTML or try to load 'js-test-pre.js', the crash won't happen.
+// Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.addEventListener("DOMCharacterDataModified", function() {
+ document.designMode = "on";
+ document.execCommand("SelectAll");
+ document.execCommand("Delete");
+ document.body.offsetLeft;
+ document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
+});
+</script>
+</head>
+<textarea> <
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (118470 => 118471)
--- trunk/Source/WebCore/ChangeLog 2012-05-25 04:00:42 UTC (rev 118470)
+++ trunk/Source/WebCore/ChangeLog 2012-05-25 04:38:30 UTC (rev 118471)
@@ -1,3 +1,21 @@
+2012-05-24 Hayato Ito <[email protected]>
+
+ Fix crashes caused by a DOMCharacterDataModified event on a text node.
+ https://bugs.webkit.org/show_bug.cgi?id=86953
+
+ Reviewed by Dimitri Glazkov.
+
+ TextNode can be released while CharacterData::setData() will dispatch a mutation event.
+ So protect it.
+
+ Mutation event itself should not be dispatched on the test case.
+ This is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372.
+
+ Test: fast/events/dom-character-data-modified-textarea-crash.html
+
+ * dom/CharacterData.cpp:
+ (WebCore::CharacterData::setData):
+
2012-05-24 Philippe Normand <[email protected]>
[GTK] Add --enable-css3-flexbox configure option after r118304.
Modified: trunk/Source/WebCore/dom/CharacterData.cpp (118470 => 118471)
--- trunk/Source/WebCore/dom/CharacterData.cpp 2012-05-25 04:00:42 UTC (rev 118470)
+++ trunk/Source/WebCore/dom/CharacterData.cpp 2012-05-25 04:38:30 UTC (rev 118471)
@@ -44,6 +44,8 @@
if (m_data == nonNullData)
return;
+ RefPtr<CharacterData> protect = this;
+
unsigned oldLength = length();
setDataAndUpdate(nonNullData, 0, oldLength, nonNullData.length());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
