Title: [139100] trunk
- Revision
- 139100
- Author
- [email protected]
- Date
- 2013-01-08 13:08:15 -0800 (Tue, 08 Jan 2013)
Log Message
Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
<http://webkit.org/b/105834>
Reviewed by Antti Koivisto.
Source/WebCore:
Suppress the DOMSubtreeModified event when synchronizing the "style" attribute and we've
instantiated an Attr node wrapper for the said attribute.
Also added an assertion that Document's StyleResolver isn't cleared during style recalc,
which will help us catch this kind of bug in the future.
Test: fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html
* dom/Document.cpp:
(WebCore::Document::styleResolverThrowawayTimerFired):
* dom/Element.cpp:
(WebCore::Element::setAttributeInternal):
LayoutTests:
* fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt: Added.
* fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (139099 => 139100)
--- trunk/LayoutTests/ChangeLog 2013-01-08 21:04:55 UTC (rev 139099)
+++ trunk/LayoutTests/ChangeLog 2013-01-08 21:08:15 UTC (rev 139100)
@@ -1,3 +1,13 @@
+2013-01-08 Andreas Kling <[email protected]>
+
+ Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
+ <http://webkit.org/b/105834>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt: Added.
+ * fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html: Added.
+
2013-01-08 Filip Pizlo <[email protected]>
DFG initrinsic handling should ensure that we backwards propagate the fact that all operands may escape
Added: trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt (0 => 139100)
--- trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt 2013-01-08 21:08:15 UTC (rev 139100)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS, assuming we didn't crash.
Added: trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html (0 => 139100)
--- trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html 2013-01-08 21:08:15 UTC (rev 139100)
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head id=head1 style="border-right-color: inherit;">
+<style>
+*[foo^=""] { border: inherit; }
+</style>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+if (window.testRunner) {
+ testRunner.dumpAsText();
+}
+
+function handleSubtreeModifiedEvent() {
+ document.open();
+ document.write("FAIL. WebKit shouldn't dispatch a DOMSubtreeModified event when element inline style is modified through CSSOM.");
+ document.close();
+ finishJSTest();
+}
+
+function everythingWentBetterThanExpected() {
+ document.open();
+ document.write("PASS, assuming we didn't crash.");
+ document.close();
+ finishJSTest();
+}
+
+function load() {
+ head1.attributes[1].addEventListener("DOMSubtreeModified", handleSubtreeModifiedEvent, false);
+ head1.style.display = "none";
+ setTimeout("everythingWentBetterThanExpected()", 0);
+}
+
+document.addEventListener("DOMContentLoaded", load, false);
+</script>
+<body>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (139099 => 139100)
--- trunk/Source/WebCore/ChangeLog 2013-01-08 21:04:55 UTC (rev 139099)
+++ trunk/Source/WebCore/ChangeLog 2013-01-08 21:08:15 UTC (rev 139100)
@@ -1,3 +1,23 @@
+2013-01-08 Andreas Kling <[email protected]>
+
+ Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
+ <http://webkit.org/b/105834>
+
+ Reviewed by Antti Koivisto.
+
+ Suppress the DOMSubtreeModified event when synchronizing the "style" attribute and we've
+ instantiated an Attr node wrapper for the said attribute.
+
+ Also added an assertion that Document's StyleResolver isn't cleared during style recalc,
+ which will help us catch this kind of bug in the future.
+
+ Test: fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::styleResolverThrowawayTimerFired):
+ * dom/Element.cpp:
+ (WebCore::Element::setAttributeInternal):
+
2013-01-08 Sheriff Bot <[email protected]>
Unreviewed, rolling out r139096.
Modified: trunk/Source/WebCore/dom/Document.cpp (139099 => 139100)
--- trunk/Source/WebCore/dom/Document.cpp 2013-01-08 21:04:55 UTC (rev 139099)
+++ trunk/Source/WebCore/dom/Document.cpp 2013-01-08 21:08:15 UTC (rev 139100)
@@ -4435,6 +4435,7 @@
void Document::styleResolverThrowawayTimerFired(Timer<Document>*)
{
+ ASSERT(!m_inStyleRecalc);
clearStyleResolver();
}
Modified: trunk/Source/WebCore/dom/Element.cpp (139099 => 139100)
--- trunk/Source/WebCore/dom/Element.cpp 2013-01-08 21:04:55 UTC (rev 139099)
+++ trunk/Source/WebCore/dom/Element.cpp 2013-01-08 21:08:15 UTC (rev 139100)
@@ -747,7 +747,7 @@
// If there is an Attr node hooked to this attribute, the Attr::setValue() call below
// will write into the ElementAttributeData.
// FIXME: Refactor this so it makes some sense.
- if (RefPtr<Attr> attrNode = attrIfExists(name))
+ if (RefPtr<Attr> attrNode = inSynchronizationOfLazyAttribute ? 0 : attrIfExists(name))
attrNode->setValue(newValue);
else
mutableAttributeData()->attributeItem(index)->setValue(newValue);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
