Diff
Modified: branches/safari-536.26-branch/LayoutTests/ChangeLog (125133 => 125134)
--- branches/safari-536.26-branch/LayoutTests/ChangeLog 2012-08-09 01:11:35 UTC (rev 125133)
+++ branches/safari-536.26-branch/LayoutTests/ChangeLog 2012-08-09 01:14:09 UTC (rev 125134)
@@ -1,5 +1,19 @@
2012-08-07 Lucas Forschler <[email protected]>
+ Merge 123121
+
+ 2012-07-19 James Simonsen <[email protected]>
+
+ Regression(120096): Protect the element used by ImageLoader until the end of notifyFinished().
+ https://bugs.webkit.org/show_bug.cgi?id=90471
+
+ Reviewed by Brady Eidson.
+
+ * http/tests/security/video-poster-cross-origin-crash-expected.txt: Added.
+ * http/tests/security/video-poster-cross-origin-crash.html: Added. From fuzzer.
+
+2012-08-07 Lucas Forschler <[email protected]>
+
Merge 120096
2012-06-12 Brady Eidson <[email protected]>
Copied: branches/safari-536.26-branch/LayoutTests/http/tests/security/video-poster-cross-origin-crash-expected.txt (from rev 123121, trunk/LayoutTests/http/tests/security/video-poster-cross-origin-crash-expected.txt) (0 => 125134)
--- branches/safari-536.26-branch/LayoutTests/http/tests/security/video-poster-cross-origin-crash-expected.txt (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/http/tests/security/video-poster-cross-origin-crash-expected.txt 2012-08-09 01:14:09 UTC (rev 125134)
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: Cross-origin image load denied by Cross-Origin Resource Sharing policy.
+CONSOLE MESSAGE: Cross-origin image load denied by Cross-Origin Resource Sharing policy.
+>>>
Copied: branches/safari-536.26-branch/LayoutTests/http/tests/security/video-poster-cross-origin-crash.html (from rev 123121, trunk/LayoutTests/http/tests/security/video-poster-cross-origin-crash.html) (0 => 125134)
--- branches/safari-536.26-branch/LayoutTests/http/tests/security/video-poster-cross-origin-crash.html (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/http/tests/security/video-poster-cross-origin-crash.html 2012-08-09 01:14:09 UTC (rev 125134)
@@ -0,0 +1,23 @@
+<sub id=tCF1></sub>>>><button hidden=false id=tCF7>><video crossorigin="" poster="http://localhost:8080/misc/resources/compass.jpg">><style>
+.c29:nth-child(1814762996n + 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999) { -webkit-locale: "zh_CN";</style><script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+try { tCF44 = document.createElementNS("http://www.w3.org/1999/xhtml", "multicol"); } catch(e) {}
+try { tCF44.setAttribute("class", "c29"); } catch(e) {}
+try { docElement.appendChild(tCF44); } catch(e) {}
+setTimeout("CFcrash()", 400);
+}
+window._onload_ = initCF;
+function editFuzz() {
+}
+function CFcrash() {
+try { if (tCF1 != docElement) tCF1.parentNode.removeChild(tCF1); } catch(e) {}
+window.scrollBy(-484, -400);
+try { tCF7.innerText = tCF44.textContent; } catch(e) {}
+if (window.testRunner)
+ testRunner.notifyDone();
+}</script>
Modified: branches/safari-536.26-branch/Source/WebCore/ChangeLog (125133 => 125134)
--- branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-08-09 01:11:35 UTC (rev 125133)
+++ branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-08-09 01:14:09 UTC (rev 125134)
@@ -1,5 +1,28 @@
2012-08-07 Lucas Forschler <[email protected]>
+ Merge 123121
+
+ 2012-07-19 James Simonsen <[email protected]>
+
+ Regression(120096): Protect the element used by ImageLoader until the end of notifyFinished().
+ https://bugs.webkit.org/show_bug.cgi?id=90471
+
+ Reviewed by Brady Eidson.
+
+ Test: http/tests/security/video-poster-cross-origin-crash.html
+
+ * html/HTMLImageLoader.cpp:
+ (WebCore::HTMLImageLoader::notifyFinished): Hang on to the element until we're done.
+ * loader/ImageLoader.cpp:
+ (WebCore::ImageLoader::setImage): No behavior change.
+ (WebCore):
+ (WebCore::ImageLoader::setImageWithoutConsideringPendingLoadEvent): Split off from old setImage, minus calling updatedHasPendingLoadEvent().
+ (WebCore::ImageLoader::notifyFinished): Invoke updatedHasPendingLoadEvent when done with cross origin errors.
+ * loader/ImageLoader.h:
+ (ImageLoader):
+
+2012-08-07 Lucas Forschler <[email protected]>
+
Merge 120096
2012-06-12 Brady Eidson <[email protected]>
Modified: branches/safari-536.26-branch/Source/WebCore/html/HTMLImageLoader.cpp (125133 => 125134)
--- branches/safari-536.26-branch/Source/WebCore/html/HTMLImageLoader.cpp 2012-08-09 01:11:35 UTC (rev 125133)
+++ branches/safari-536.26-branch/Source/WebCore/html/HTMLImageLoader.cpp 2012-08-09 01:14:09 UTC (rev 125134)
@@ -74,13 +74,13 @@
{
CachedImage* cachedImage = image();
- Element* elem = element();
+ RefPtr<Element> protectElement = element();
ImageLoader::notifyFinished(cachedImage);
bool loadError = cachedImage->errorOccurred() || cachedImage->response().httpStatusCode() >= 400;
#if USE(JSC)
if (!loadError) {
- if (!elem->inDocument()) {
+ if (!protectElement->inDocument()) {
JSC::JSLock lock(JSC::SilenceAssertionsOnly);
JSC::JSGlobalData* globalData = JSDOMWindowBase::commonJSGlobalData();
globalData->heap.reportExtraMemoryCost(cachedImage->encodedSize());
@@ -88,8 +88,8 @@
}
#endif
- if (loadError && elem->hasTagName(HTMLNames::objectTag))
- static_cast<HTMLObjectElement*>(elem)->renderFallbackContent();
+ if (loadError && protectElement->hasTagName(HTMLNames::objectTag))
+ static_cast<HTMLObjectElement*>(protectElement.get())->renderFallbackContent();
}
}
Modified: branches/safari-536.26-branch/Source/WebCore/loader/ImageLoader.cpp (125133 => 125134)
--- branches/safari-536.26-branch/Source/WebCore/loader/ImageLoader.cpp 2012-08-09 01:11:35 UTC (rev 125133)
+++ branches/safari-536.26-branch/Source/WebCore/loader/ImageLoader.cpp 2012-08-09 01:14:09 UTC (rev 125134)
@@ -118,6 +118,15 @@
void ImageLoader::setImage(CachedImage* newImage)
{
+ setImageWithoutConsideringPendingLoadEvent(newImage);
+
+ // Only consider updating the protection ref-count of the Element immediately before returning
+ // from this function as doing so might result in the destruction of this ImageLoader.
+ updatedHasPendingLoadEvent();
+}
+
+void ImageLoader::setImageWithoutConsideringPendingLoadEvent(CachedImage* newImage)
+{
ASSERT(m_failedLoadURL.isEmpty());
CachedImage* oldImage = m_image.get();
if (newImage != oldImage) {
@@ -257,7 +266,7 @@
&& !m_element->document()->securityOrigin()->canRequest(image()->response().url())
&& !resource->passesAccessControlCheck(m_element->document()->securityOrigin())) {
- setImage(0);
+ setImageWithoutConsideringPendingLoadEvent(0);
m_hasPendingErrorEvent = true;
errorEventSender().dispatchEventSoon(this);
@@ -266,6 +275,10 @@
m_element->document()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage);
ASSERT(!m_hasPendingLoadEvent);
+
+ // Only consider updating the protection ref-count of the Element immediately before returning
+ // from this function as doing so might result in the destruction of this ImageLoader.
+ updatedHasPendingLoadEvent();
return;
}
Modified: branches/safari-536.26-branch/Source/WebCore/loader/ImageLoader.h (125133 => 125134)
--- branches/safari-536.26-branch/Source/WebCore/loader/ImageLoader.h 2012-08-09 01:11:35 UTC (rev 125133)
+++ branches/safari-536.26-branch/Source/WebCore/loader/ImageLoader.h 2012-08-09 01:14:09 UTC (rev 125134)
@@ -85,6 +85,8 @@
void updateRenderer();
Element* m_element;
+ void setImageWithoutConsideringPendingLoadEvent(CachedImage*);
+
CachedResourceHandle<CachedImage> m_image;
AtomicString m_failedLoadURL;
bool m_hasPendingBeforeLoadEvent : 1;
