Title: [137341] trunk
- Revision
- 137341
- Author
- [email protected]
- Date
- 2012-12-11 12:46:56 -0800 (Tue, 11 Dec 2012)
Log Message
REGRESSION(r133492): Heap-use-after-free in WebCore::Element::normalizeAttributes
<http://webkit.org/b/104488>
Reviewed by Antti Koivisto.
Source/WebCore:
Don't cache the AttrNodeList* in a local when iterating over an Element's Attr nodes since
that pointer may go stale if JS runs in response to a DOMSubtreeModified event below Node::normalize().
Test: fast/dom/normalize-attributes-mutation-event-crash.html
* dom/Element.cpp:
(WebCore::Element::normalizeAttributes):
LayoutTests:
* fast/dom/normalize-attributes-mutation-event-crash-expected.txt: Added.
* fast/dom/normalize-attributes-mutation-event-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (137340 => 137341)
--- trunk/LayoutTests/ChangeLog 2012-12-11 20:35:12 UTC (rev 137340)
+++ trunk/LayoutTests/ChangeLog 2012-12-11 20:46:56 UTC (rev 137341)
@@ -1,3 +1,13 @@
+2012-12-11 Andreas Kling <[email protected]>
+
+ REGRESSION(r133492): Heap-use-after-free in WebCore::Element::normalizeAttributes
+ <http://webkit.org/b/104488>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/dom/normalize-attributes-mutation-event-crash-expected.txt: Added.
+ * fast/dom/normalize-attributes-mutation-event-crash.html: Added.
+
2012-12-11 Beth Dakin <[email protected]>
Updating these test results after http://trac.webkit.org/changeset/137006
Added: trunk/LayoutTests/fast/dom/normalize-attributes-mutation-event-crash-expected.txt (0 => 137341)
--- trunk/LayoutTests/fast/dom/normalize-attributes-mutation-event-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/normalize-attributes-mutation-event-crash-expected.txt 2012-12-11 20:46:56 UTC (rev 137341)
@@ -0,0 +1,9 @@
+Tests that mutating an elements attribute map during DOMSubtreeModified event dispatch doesn't break Node.normalize. Passes if it doesn't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/normalize-attributes-mutation-event-crash.html (0 => 137341)
--- trunk/LayoutTests/fast/dom/normalize-attributes-mutation-event-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/normalize-attributes-mutation-event-crash.html 2012-12-11 20:46:56 UTC (rev 137341)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src=""
+</head>
+<body>
+<script>
+
+description("Tests that mutating an elements attribute map during DOMSubtreeModified event dispatch doesn't break Node.normalize. Passes if it doesn't crash.");
+
+var el = document.createElement('div')
+el.setAttribute('a', 'a')
+el.setAttribute('b', 'b')
+el.attributes[1].appendChild(document.createTextNode())
+el.attributes[1].addEventListener('DOMSubtreeModified', function() { el.removeAttribute('b') }, false)
+el.normalize()
+
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (137340 => 137341)
--- trunk/Source/WebCore/ChangeLog 2012-12-11 20:35:12 UTC (rev 137340)
+++ trunk/Source/WebCore/ChangeLog 2012-12-11 20:46:56 UTC (rev 137341)
@@ -1,3 +1,18 @@
+2012-12-11 Andreas Kling <[email protected]>
+
+ REGRESSION(r133492): Heap-use-after-free in WebCore::Element::normalizeAttributes
+ <http://webkit.org/b/104488>
+
+ Reviewed by Antti Koivisto.
+
+ Don't cache the AttrNodeList* in a local when iterating over an Element's Attr nodes since
+ that pointer may go stale if JS runs in response to a DOMSubtreeModified event below Node::normalize().
+
+ Test: fast/dom/normalize-attributes-mutation-event-crash.html
+
+ * dom/Element.cpp:
+ (WebCore::Element::normalizeAttributes):
+
2012-12-11 Jonathon Jongsma <[email protected]>
[GTK] Soup network logs are frequently interrupted by other logging messages
Modified: trunk/Source/WebCore/dom/Element.cpp (137340 => 137341)
--- trunk/Source/WebCore/dom/Element.cpp 2012-12-11 20:35:12 UTC (rev 137340)
+++ trunk/Source/WebCore/dom/Element.cpp 2012-12-11 20:46:56 UTC (rev 137341)
@@ -2087,10 +2087,11 @@
void Element::normalizeAttributes()
{
- updateInvalidAttributes();
- if (AttrNodeList* attrNodeList = attrNodeListForElement(this)) {
- for (unsigned i = 0; i < attrNodeList->size(); ++i)
- attrNodeList->at(i)->normalize();
+ if (!hasAttributes())
+ return;
+ for (unsigned i = 0; i < attributeCount(); ++i) {
+ if (RefPtr<Attr> attr = attrIfExists(attributeItem(i)->name()))
+ attr->normalize();
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
