Title: [136560] trunk
- Revision
- 136560
- Author
- [email protected]
- Date
- 2012-12-04 13:50:18 -0800 (Tue, 04 Dec 2012)
Log Message
Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
https://bugs.webkit.org/show_bug.cgi?id=100621
Reviewed by Eric Seidel.
Source/WebCore:
r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
is cleared when CSSImageSetValue is going away.
Test: fast/css/image-set-value-not-removed-crash.html
* css/CSSImageSetValue.cpp:
(WebCore::CSSImageSetValue::~CSSImageSetValue):
* rendering/style/StyleCachedImageSet.h:
(WebCore::StyleCachedImageSet::clearImageSetValue):
(StyleCachedImageSet):
LayoutTests:
* fast/css/image-set-value-not-removed-crash-expected.txt: Added.
* fast/css/image-set-value-not-removed-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (136559 => 136560)
--- trunk/LayoutTests/ChangeLog 2012-12-04 21:46:07 UTC (rev 136559)
+++ trunk/LayoutTests/ChangeLog 2012-12-04 21:50:18 UTC (rev 136560)
@@ -1,5 +1,15 @@
2012-12-04 Abhishek Arya <[email protected]>
+ Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
+ https://bugs.webkit.org/show_bug.cgi?id=100621
+
+ Reviewed by Eric Seidel.
+
+ * fast/css/image-set-value-not-removed-crash-expected.txt: Added.
+ * fast/css/image-set-value-not-removed-crash.html: Added.
+
+2012-12-04 Abhishek Arya <[email protected]>
+
Crash in CachedResource::checkNotify due to -webkit-crossfade.
https://bugs.webkit.org/show_bug.cgi?id=98068
Added: trunk/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt (0 => 136560)
--- trunk/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt 2012-12-04 21:50:18 UTC (rev 136560)
@@ -0,0 +1,2 @@
+PASS. WebKit didn't crash.
+
Added: trunk/LayoutTests/fast/css/image-set-value-not-removed-crash.html (0 => 136560)
--- trunk/LayoutTests/fast/css/image-set-value-not-removed-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/image-set-value-not-removed-crash.html 2012-12-04 21:50:18 UTC (rev 136560)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+A
+<style>
+@-webkit-keyframes anim1 {
+ 0% {
+ opacity: 0.5772; border-image: 26829%;
+ }
+ 100% {
+ opacity: 0.3167;
+ }
+}
+* {
+ -webkit-animation-name: anim1;
+ -webkit-animation-duration: 1s;
+}
+.class1 {
+ border-image: -webkit-image-set(url(#does-not-exist) 25x, url("does-not-exist.gif") 206x) 2 126 158 166 fill;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var docElement = document.body;
+docElement.contentEditable = "true";
+
+function crash() {
+ test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ test1.setAttribute("class", "class1");
+ docElement.appendChild(test1);
+ document.execCommand("SelectAll", false, null)
+ document.execCommand("InsertText", false, "PASS. WebKit didn't crash.")
+ for (i = 0; i != 49; i++)
+ window.getSelection().modify("move", "forward", "character");
+
+ document.execCommand("Italic", false, null);
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>
\ No newline at end of file
Property changes on: trunk/LayoutTests/fast/css/image-set-value-not-removed-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (136559 => 136560)
--- trunk/Source/WebCore/ChangeLog 2012-12-04 21:46:07 UTC (rev 136559)
+++ trunk/Source/WebCore/ChangeLog 2012-12-04 21:50:18 UTC (rev 136560)
@@ -1,3 +1,23 @@
+2012-12-04 Abhishek Arya <[email protected]>
+
+ Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
+ https://bugs.webkit.org/show_bug.cgi?id=100621
+
+ Reviewed by Eric Seidel.
+
+ r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
+ and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
+ a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
+ is cleared when CSSImageSetValue is going away.
+
+ Test: fast/css/image-set-value-not-removed-crash.html
+
+ * css/CSSImageSetValue.cpp:
+ (WebCore::CSSImageSetValue::~CSSImageSetValue):
+ * rendering/style/StyleCachedImageSet.h:
+ (WebCore::StyleCachedImageSet::clearImageSetValue):
+ (StyleCachedImageSet):
+
2012-12-04 Adam Barth <[email protected]>
NodeFilter leaks memory in V8
Modified: trunk/Source/WebCore/css/CSSImageSetValue.cpp (136559 => 136560)
--- trunk/Source/WebCore/css/CSSImageSetValue.cpp 2012-12-04 21:46:07 UTC (rev 136559)
+++ trunk/Source/WebCore/css/CSSImageSetValue.cpp 2012-12-04 21:50:18 UTC (rev 136560)
@@ -52,6 +52,8 @@
CSSImageSetValue::~CSSImageSetValue()
{
+ if (m_imageSet && m_imageSet->isCachedImageSet())
+ static_cast<StyleCachedImageSet*>(m_imageSet.get())->clearImageSetValue();
}
void CSSImageSetValue::fillImageSet()
Modified: trunk/Source/WebCore/rendering/style/StyleCachedImageSet.h (136559 => 136560)
--- trunk/Source/WebCore/rendering/style/StyleCachedImageSet.h 2012-12-04 21:46:07 UTC (rev 136559)
+++ trunk/Source/WebCore/rendering/style/StyleCachedImageSet.h 2012-12-04 21:50:18 UTC (rev 136560)
@@ -58,6 +58,8 @@
CachedImage* cachedImage() const { return m_bestFitImage.get(); }
+ void clearImageSetValue() { m_imageSetValue = 0; }
+
virtual bool canRender(const RenderObject*, float multiplier) const;
virtual bool isLoaded() const;
virtual bool errorOccurred() const;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
