Title: [119334] releases/WebKitGTK/webkit-1.8
Revision
119334
Author
[email protected]
Date
2012-06-02 13:30:51 -0700 (Sat, 02 Jun 2012)

Log Message

Merge 115398 - Invalid cast in WebCore::HTMLCollection::isAcceptableElement
https://bugs.webkit.org/show_bug.cgi?id=84626

Reviewed by Darin Adler.

Source/WebCore:

Check if the object is an HTMLElement before casting.

Test: fast/dom/htmlcollection-non-html.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::isAcceptableElement):

LayoutTests:

Add tests to make sure only HTML elements are present in most HTMLCollection objects.

* fast/dom/htmlcollection-non-html-option-expected.txt: Added.
* fast/dom/htmlcollection-non-html.html: Added.

Modified Paths

Added Paths

Diff

Modified: releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog (119333 => 119334)


--- releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog	2012-06-02 20:30:30 UTC (rev 119333)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog	2012-06-02 20:30:51 UTC (rev 119334)
@@ -1,3 +1,15 @@
+2012-04-26  Jeffrey Pfau  <[email protected]>
+
+        Invalid cast in WebCore::HTMLCollection::isAcceptableElement
+        https://bugs.webkit.org/show_bug.cgi?id=84626
+
+        Reviewed by Darin Adler.
+
+        Add tests to make sure only HTML elements are present in most HTMLCollection objects.
+
+        * fast/dom/htmlcollection-non-html-option-expected.txt: Added.
+        * fast/dom/htmlcollection-non-html.html: Added.
+
 2012-04-25  Nate Chapin  <[email protected]>
 
         Test for https://bugs.webkit.org/show_bug.cgi?id=83632.

Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/htmlcollection-non-html-expected.txt (0 => 119334)


--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/htmlcollection-non-html-expected.txt	                        (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/htmlcollection-non-html-expected.txt	2012-06-02 20:30:51 UTC (rev 119334)
@@ -0,0 +1,42 @@
+Tests that HTMLCollection only properly contains HTML elements
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS select.options.length is 0
+PASS select.selectedOptions.length is 0
+PASS select.options.length is 1
+PASS document.images.length is 0
+PASS document.images.length is 1
+PASS document.forms.length is 0
+PASS document.forms.length is 1
+PASS document.applets.length is 0
+PASS document.applets.length is 1
+PASS document.embeds.length is 0
+PASS document.embeds.length is 1
+PASS document.scripts.length is 3
+PASS document.scripts.length is 4
+PASS document.links.length is 0
+PASS document.links.length is 1
+PASS document.links.length is 0
+PASS document.links.length is 1
+PASS document.anchors.length is 0
+PASS document.anchors.length is 1
+PASS elem.areas.length is 0
+PASS elem.areas.length is 1
+PASS elem.rows.length is 0
+PASS elem.rows.length is 1
+PASS elem.tBodies.length is 0
+PASS elem.tBodies.length is 1
+PASS elem.cells.length is 0
+PASS elem.cells.length is 1
+PASS elem.rows.length is 0
+PASS elem.rows.length is 1
+PASS elem.rows.length is 0
+PASS elem.rows.length is 1
+PASS elem.rows.length is 0
+PASS elem.rows.length is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/htmlcollection-non-html.html (0 => 119334)


--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/htmlcollection-non-html.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/htmlcollection-non-html.html	2012-06-02 20:30:51 UTC (rev 119334)
@@ -0,0 +1,102 @@
+<html>
+<head>
+<script src=""
+<script>
+var elem;
+var ns = "http://not-html.test";
+
+function testDocumentProperty(attributeName, elementName, base) {
+  var elem;
+  if (typeof base == 'undefined')
+    base = 0;
+
+  elem = document.createElementNS(ns, elementName);
+  document.body.appendChild(elem);
+  shouldBe("document." + attributeName + ".length", base + "");
+  document.body.removeChild(elem);
+
+  elem = document.createElement(elementName);
+  document.body.appendChild(elem);
+  shouldBe("document." + attributeName + ".length", base + 1 + "");
+  document.body.removeChild(elem);
+}
+
+function testDocumentPropertyWithAttribute(attributeName, elementName, elementAttributeName, base) {
+  var elem;
+  if (typeof base == 'undefined')
+    base = 0;
+
+  elem = document.createElementNS(ns, elementName);
+  elem.setAttribute(elementAttributeName, "foo");
+  document.body.appendChild(elem);
+  shouldBe("document." + attributeName + ".length", base + "");
+  document.body.removeChild(elem);
+
+  elem = document.createElement(elementName);
+  elem.setAttribute(elementAttributeName, "foo");
+  document.body.appendChild(elem);
+  shouldBe("document." + attributeName + ".length", base + 1 + "");
+  document.body.removeChild(elem);
+}
+
+function testElementProperty(elementName, attributeName, subelementName, base) {
+  var subelem;
+  if (typeof base == 'undefined')
+    base = 0;
+
+  elem = document.createElement(elementName);
+  subelem = document.createElementNS(ns, subelementName);
+  elem.appendChild(subelem);
+  shouldBe("elem." + attributeName + ".length", base + "");
+  elem.removeChild(subelem);
+
+  subelem = document.createElement(subelementName);
+  elem.appendChild(subelem);
+  shouldBe("elem." + attributeName + ".length", base + 1 + "");
+  elem.removeChild(subelem);
+}
+
+function runTest() {
+  if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+
+  description('Tests that HTMLCollection only properly contains HTML elements');
+
+  var elem;
+  select = document.createElement("select");
+  elem = document.createElementNS(ns, "option");
+  select.appendChild(elem);
+  shouldBe("select.options.length", "0");
+  shouldBe("select.selectedOptions.length", "0");
+
+  elem = document.createElement("option");
+  select.appendChild(elem);
+  shouldBe("select.options.length", "1");
+
+  testDocumentProperty("images", "img");
+  testDocumentProperty("forms", "form");
+  testDocumentProperty("applets", "applet");
+  testDocumentProperty("embeds", "embed");
+
+  // Note that this is run before the final script element on this page is inserted
+  testDocumentProperty("scripts", "script", 3);
+
+  testDocumentPropertyWithAttribute("links", "a", "href");
+  testDocumentPropertyWithAttribute("links", "area", "href");
+  testDocumentPropertyWithAttribute("anchors", "a", "name");
+
+  testElementProperty("map", "areas", "area");
+  testElementProperty("table", "rows", "tr");
+  testElementProperty("table", "tBodies", "tbody");
+  testElementProperty("tr", "cells", "td");
+  testElementProperty("thead", "rows", "tr");
+  testElementProperty("tbody", "rows", "tr");
+  testElementProperty("tfoot", "rows", "tr");
+}
+</script>
+</head>
+<body>
+  <script>runTest();</script>
+  <script src=""
+</body>
+</html>

Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog (119333 => 119334)


--- releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog	2012-06-02 20:30:30 UTC (rev 119333)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog	2012-06-02 20:30:51 UTC (rev 119334)
@@ -1,3 +1,17 @@
+2012-04-26  Jeffrey Pfau  <[email protected]>
+
+        Invalid cast in WebCore::HTMLCollection::isAcceptableElement
+        https://bugs.webkit.org/show_bug.cgi?id=84626
+
+        Reviewed by Darin Adler.
+
+        Check if the object is an HTMLElement before casting.
+
+        Test: fast/dom/htmlcollection-non-html.html
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::isAcceptableElement):
+
 2012-04-25  Nate Chapin  <[email protected]>
 
         Crash in CachedRawResource::didAddClient() due to missing protector.

Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLCollection.cpp (119333 => 119334)


--- releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLCollection.cpp	2012-06-02 20:30:30 UTC (rev 119333)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLCollection.cpp	2012-06-02 20:30:51 UTC (rev 119334)
@@ -99,6 +99,9 @@
 
 inline bool HTMLCollection::isAcceptableElement(Element* element) const
 {
+    if (!element->isHTMLElement() && !(m_type == DocAll || m_type == NodeChildren))
+        return false;
+
     switch (m_type) {
     case DocImages:
         return element->hasLocalName(imgTag);
@@ -138,7 +141,7 @@
         return true;
 #if ENABLE(MICRODATA)
     case ItemProperties:
-        return element->isHTMLElement() && element->fastHasAttribute(itempropAttr);
+        return element->fastHasAttribute(itempropAttr);
 #endif
     case DocumentNamedItems:
     case OtherCollection:
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to