Diff
Modified: trunk/Source/WebCore/ChangeLog (145398 => 145399)
--- trunk/Source/WebCore/ChangeLog 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/ChangeLog 2013-03-11 20:57:44 UTC (rev 145399)
@@ -1,3 +1,81 @@
+2013-03-11 Abhishek Arya <[email protected]>
+
+ Add ASSERT_WITH_SECURITY_IMPLICATION to catch bad casts.
+ https://bugs.webkit.org/show_bug.cgi?id=112060
+
+ Reviewed by Eric Seidel.
+
+ * Modules/geolocation/Geolocation.cpp:
+ (WebCore::Geolocation::document):
+ * accessibility/AccessibilityMenuList.h:
+ (WebCore::toAccessibilityMenuList):
+ * accessibility/AccessibilityNodeObject.h:
+ (WebCore::toAccessibilityNodeObject):
+ * accessibility/AccessibilityRenderObject.h:
+ (WebCore::toAccessibilityRenderObject):
+ * accessibility/AccessibilitySVGRoot.h:
+ (WebCore::toAccessibilitySVGRoot):
+ * accessibility/AccessibilitySpinButton.h:
+ (WebCore::toAccessibilitySpinButton):
+ (WebCore::toAccessibilitySpinButtonPart):
+ * accessibility/AccessibilityTable.h:
+ (WebCore::toAccessibilityTable):
+ * css/StyleRule.h:
+ (WebCore::toStyleRuleMedia):
+ (WebCore::toStyleRuleSupports):
+ (WebCore::toStyleRuleRegion):
+ * dom/EventContext.h:
+ (WebCore::toTouchEventContext):
+ * fileapi/File.h:
+ (WebCore::toFile):
+ * html/HTMLElement.cpp:
+ (WebCore::HTMLElement::insertAdjacentElement):
+ (WebCore::contextElementForInsertion):
+ * html/HTMLMediaElement.h:
+ (WebCore::toMediaElement):
+ * html/HTMLMeterElement.h:
+ (WebCore::toHTMLMeterElement):
+ * html/HTMLOptionElement.cpp:
+ (WebCore::toHTMLOptionElement):
+ * html/HTMLProgressElement.cpp:
+ (WebCore::HTMLProgressElement::renderProgress):
+ * html/HTMLProgressElement.h:
+ (WebCore::toHTMLProgressElement):
+ * html/HTMLSelectElement.h:
+ (WebCore::toHTMLSelectElement):
+ * html/HTMLTableCellElement.cpp:
+ (WebCore::toHTMLTableCellElement):
+ * html/HTMLTextFormControlElement.h:
+ (WebCore::toHTMLTextFormControlElement):
+ * html/PluginDocument.h:
+ (WebCore::toPluginDocument):
+ * html/shadow/DetailsMarkerControl.cpp:
+ (WebCore::DetailsMarkerControl::summaryElement):
+ * html/shadow/HTMLContentElement.h:
+ (WebCore::toHTMLContentElement):
+ * html/shadow/HTMLShadowElement.h:
+ (WebCore::toHTMLShadowElement):
+ * html/shadow/TextFieldDecorationElement.cpp:
+ (WebCore::TextFieldDecorationElement::hostInput):
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::document):
+ * rendering/InlineTextBox.h:
+ (WebCore::toInlineTextBox):
+ * rendering/RenderHTMLCanvas.h:
+ (WebCore::toRenderHTMLCanvas):
+ * rendering/RenderScrollbar.h:
+ (WebCore::toRenderScrollbar):
+ * rendering/RenderTextFragment.h:
+ (WebCore::toRenderTextFragment):
+ * rendering/mathml/RenderMathMLOperator.h:
+ (WebCore::toRenderMathMLOperator):
+ * rendering/svg/RenderSVGTextPath.h:
+ (WebCore::toRenderSVGTextPath):
+ * rendering/svg/RenderSVGViewportContainer.h:
+ (WebCore::toRenderSVGViewportContainer):
+ * svg/graphics/SVGImageChromeClient.h:
+ (WebCore::toSVGImageChromeClient):
+
2013-03-11 Adam Barth <[email protected]>
Factor HTMLTreeBuilderSimulator out of BackgroundHTMLParser
Modified: trunk/Source/WebCore/Modules/geolocation/Geolocation.cpp (145398 => 145399)
--- trunk/Source/WebCore/Modules/geolocation/Geolocation.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/Modules/geolocation/Geolocation.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -253,7 +253,7 @@
Document* Geolocation::document() const
{
- ASSERT(!scriptExecutionContext() || scriptExecutionContext()->isDocument());
+ ASSERT_WITH_SECURITY_IMPLICATION(!scriptExecutionContext() || scriptExecutionContext()->isDocument());
return static_cast<Document*>(scriptExecutionContext());
}
Modified: trunk/Source/WebCore/accessibility/AccessibilityMenuList.h (145398 => 145399)
--- trunk/Source/WebCore/accessibility/AccessibilityMenuList.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/accessibility/AccessibilityMenuList.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -58,7 +58,7 @@
inline AccessibilityMenuList* toAccessibilityMenuList(AccessibilityObject* object)
{
- ASSERT(!object || object->isMenuList());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isMenuList());
return static_cast<AccessibilityMenuList*>(object);
}
Modified: trunk/Source/WebCore/accessibility/AccessibilityNodeObject.h (145398 => 145399)
--- trunk/Source/WebCore/accessibility/AccessibilityNodeObject.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/accessibility/AccessibilityNodeObject.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -202,13 +202,13 @@
inline AccessibilityNodeObject* toAccessibilityNodeObject(AccessibilityObject* object)
{
- ASSERT(!object || object->isAccessibilityNodeObject());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isAccessibilityNodeObject());
return static_cast<AccessibilityNodeObject*>(object);
}
inline const AccessibilityNodeObject* toAccessibilityNodeObject(const AccessibilityObject* object)
{
- ASSERT(!object || object->isAccessibilityNodeObject());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isAccessibilityNodeObject());
return static_cast<const AccessibilityNodeObject*>(object);
}
Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h (145398 => 145399)
--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -328,13 +328,13 @@
inline AccessibilityRenderObject* toAccessibilityRenderObject(AccessibilityObject* object)
{
- ASSERT(!object || object->isAccessibilityRenderObject());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isAccessibilityRenderObject());
return static_cast<AccessibilityRenderObject*>(object);
}
inline const AccessibilityRenderObject* toAccessibilityRenderObject(const AccessibilityObject* object)
{
- ASSERT(!object || object->isAccessibilityRenderObject());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isAccessibilityRenderObject());
return static_cast<const AccessibilityRenderObject*>(object);
}
Modified: trunk/Source/WebCore/accessibility/AccessibilitySVGRoot.h (145398 => 145399)
--- trunk/Source/WebCore/accessibility/AccessibilitySVGRoot.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/accessibility/AccessibilitySVGRoot.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -52,7 +52,7 @@
inline AccessibilitySVGRoot* toAccessibilitySVGRoot(AccessibilityObject* object)
{
- ASSERT(!object || object->isAccessibilitySVGRoot());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isAccessibilitySVGRoot());
return static_cast<AccessibilitySVGRoot*>(object);
}
Modified: trunk/Source/WebCore/accessibility/AccessibilitySpinButton.h (145398 => 145399)
--- trunk/Source/WebCore/accessibility/AccessibilitySpinButton.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/accessibility/AccessibilitySpinButton.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -77,13 +77,13 @@
inline AccessibilitySpinButton* toAccessibilitySpinButton(AccessibilityObject* object)
{
- ASSERT(!object || object->isSpinButton());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isSpinButton());
return static_cast<AccessibilitySpinButton*>(object);
}
inline AccessibilitySpinButtonPart* toAccessibilitySpinButtonPart(AccessibilityObject* object)
{
- ASSERT(!object || object->isSpinButtonPart());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isSpinButtonPart());
return static_cast<AccessibilitySpinButtonPart*>(object);
}
Modified: trunk/Source/WebCore/accessibility/AccessibilityTable.h (145398 => 145399)
--- trunk/Source/WebCore/accessibility/AccessibilityTable.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/accessibility/AccessibilityTable.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -90,7 +90,7 @@
inline AccessibilityTable* toAccessibilityTable(AccessibilityObject* object)
{
- ASSERT(!object || object->isAccessibilityTable());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isAccessibilityTable());
return static_cast<AccessibilityTable*>(object);
}
Modified: trunk/Source/WebCore/css/StyleRule.h (145398 => 145399)
--- trunk/Source/WebCore/css/StyleRule.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/css/StyleRule.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -311,21 +311,21 @@
inline const StyleRuleMedia* toStyleRuleMedia(const StyleRuleGroup* rule)
{
- ASSERT(!rule || rule->isMediaRule());
+ ASSERT_WITH_SECURITY_IMPLICATION(!rule || rule->isMediaRule());
return static_cast<const StyleRuleMedia*>(rule);
}
#if ENABLE(CSS3_CONDITIONAL_RULES)
inline const StyleRuleSupports* toStyleRuleSupports(const StyleRuleGroup* rule)
{
- ASSERT(!rule || rule->isSupportsRule());
+ ASSERT_WITH_SECURITY_IMPLICATION(!rule || rule->isSupportsRule());
return static_cast<const StyleRuleSupports*>(rule);
}
#endif
inline const StyleRuleRegion* toStyleRuleRegion(const StyleRuleGroup* rule)
{
- ASSERT(!rule || rule->isRegionRule());
+ ASSERT_WITH_SECURITY_IMPLICATION(!rule || rule->isRegionRule());
return static_cast<const StyleRuleRegion*>(rule);
}
Modified: trunk/Source/WebCore/dom/EventContext.h (145398 => 145399)
--- trunk/Source/WebCore/dom/EventContext.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/dom/EventContext.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -102,7 +102,7 @@
inline TouchEventContext* toTouchEventContext(EventContext* eventContext)
{
- ASSERT(!eventContext || eventContext->isTouchEventContext());
+ ASSERT_WITH_SECURITY_IMPLICATION(!eventContext || eventContext->isTouchEventContext());
return static_cast<TouchEventContext*>(eventContext);
}
#endif // ENABLE(TOUCH_EVENTS)
Modified: trunk/Source/WebCore/fileapi/File.h (145398 => 145399)
--- trunk/Source/WebCore/fileapi/File.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/fileapi/File.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -136,13 +136,13 @@
inline File* toFile(Blob* blob)
{
- ASSERT(!blob || blob->isFile());
+ ASSERT_WITH_SECURITY_IMPLICATION(!blob || blob->isFile());
return static_cast<File*>(blob);
}
inline const File* toFile(const Blob* blob)
{
- ASSERT(!blob || blob->isFile());
+ ASSERT_WITH_SECURITY_IMPLICATION(!blob || blob->isFile());
return static_cast<const File*>(blob);
}
Modified: trunk/Source/WebCore/html/HTMLElement.cpp (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLElement.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLElement.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -562,7 +562,7 @@
}
Node* returnValue = insertAdjacent(where, newChild, ec);
- ASSERT(!returnValue || returnValue->isElementNode());
+ ASSERT_WITH_SECURITY_IMPLICATION(!returnValue || returnValue->isElementNode());
return static_cast<Element*>(returnValue);
}
@@ -575,7 +575,7 @@
ec = NO_MODIFICATION_ALLOWED_ERR;
return 0;
}
- ASSERT(!parent || parent->isElementNode());
+ ASSERT_WITH_SECURITY_IMPLICATION(!parent || parent->isElementNode());
return static_cast<Element*>(parent);
}
if (equalIgnoringCase(where, "afterBegin") || equalIgnoringCase(where, "beforeEnd"))
Modified: trunk/Source/WebCore/html/HTMLMediaElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLMediaElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLMediaElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -765,7 +765,7 @@
inline HTMLMediaElement* toMediaElement(Node* node)
{
- ASSERT(!node || isMediaElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isMediaElement(node));
return static_cast<HTMLMediaElement*>(node);
}
Modified: trunk/Source/WebCore/html/HTMLMeterElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLMeterElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLMeterElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -91,7 +91,7 @@
inline HTMLMeterElement* toHTMLMeterElement(Node* node)
{
- ASSERT(!node || isHTMLMeterElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLMeterElement(node));
return static_cast<HTMLMeterElement*>(node);
}
Modified: trunk/Source/WebCore/html/HTMLOptionElement.cpp (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLOptionElement.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLOptionElement.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -393,13 +393,13 @@
HTMLOptionElement* toHTMLOptionElement(Node* node)
{
- ASSERT(!node || node->hasTagName(optionTag));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(optionTag));
return static_cast<HTMLOptionElement*>(node);
}
const HTMLOptionElement* toHTMLOptionElement(const Node* node)
{
- ASSERT(!node || node->hasTagName(optionTag));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(optionTag));
return static_cast<const HTMLOptionElement*>(node);
}
Modified: trunk/Source/WebCore/html/HTMLProgressElement.cpp (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLProgressElement.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLProgressElement.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -78,7 +78,7 @@
return static_cast<RenderProgress*>(renderer());
RenderObject* renderObject = userAgentShadowRoot()->firstChild()->renderer();
- ASSERT(!renderObject || renderObject->isProgress());
+ ASSERT_WITH_SECURITY_IMPLICATION(!renderObject || renderObject->isProgress());
return static_cast<RenderProgress*>(renderObject);
}
Modified: trunk/Source/WebCore/html/HTMLProgressElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLProgressElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLProgressElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -80,7 +80,7 @@
inline HTMLProgressElement* toHTMLProgressElement(Node* node)
{
- ASSERT(!node || isHTMLProgressElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLProgressElement(node));
return static_cast<HTMLProgressElement*>(node);
}
Modified: trunk/Source/WebCore/html/HTMLSelectElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLSelectElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLSelectElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -209,13 +209,13 @@
inline HTMLSelectElement* toHTMLSelectElement(Node* node)
{
- ASSERT(!node || isHTMLSelectElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLSelectElement(node));
return static_cast<HTMLSelectElement*>(node);
}
inline const HTMLSelectElement* toHTMLSelectElement(const Node* node)
{
- ASSERT(!node || isHTMLSelectElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLSelectElement(node));
return static_cast<const HTMLSelectElement*>(node);
}
Modified: trunk/Source/WebCore/html/HTMLTableCellElement.cpp (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLTableCellElement.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLTableCellElement.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -186,13 +186,13 @@
HTMLTableCellElement* toHTMLTableCellElement(Node* node)
{
- ASSERT(!node || node->hasTagName(HTMLNames::tdTag) || node->hasTagName(HTMLNames::thTag));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::tdTag) || node->hasTagName(HTMLNames::thTag));
return static_cast<HTMLTableCellElement*>(node);
}
const HTMLTableCellElement* toHTMLTableCellElement(const Node* node)
{
- ASSERT(!node || node->hasTagName(HTMLNames::tdTag) || node->hasTagName(HTMLNames::thTag));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || node->hasTagName(HTMLNames::tdTag) || node->hasTagName(HTMLNames::thTag));
return static_cast<const HTMLTableCellElement*>(node);
}
Modified: trunk/Source/WebCore/html/HTMLTextFormControlElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/HTMLTextFormControlElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/HTMLTextFormControlElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -148,7 +148,7 @@
inline HTMLTextFormControlElement* toHTMLTextFormControlElement(Node* node)
{
- ASSERT(!node || isHTMLTextFormControlElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLTextFormControlElement(node));
return static_cast<HTMLTextFormControlElement*>(node);
}
Modified: trunk/Source/WebCore/html/PluginDocument.h (145398 => 145399)
--- trunk/Source/WebCore/html/PluginDocument.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/PluginDocument.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -64,13 +64,13 @@
inline PluginDocument* toPluginDocument(Document* document)
{
- ASSERT(!document || document->isPluginDocument());
+ ASSERT_WITH_SECURITY_IMPLICATION(!document || document->isPluginDocument());
return static_cast<PluginDocument*>(document);
}
inline const PluginDocument* toPluginDocument(const Document* document)
{
- ASSERT(!document || document->isPluginDocument());
+ ASSERT_WITH_SECURITY_IMPLICATION(!document || document->isPluginDocument());
return static_cast<const PluginDocument*>(document);
}
Modified: trunk/Source/WebCore/html/shadow/DetailsMarkerControl.cpp (145398 => 145399)
--- trunk/Source/WebCore/html/shadow/DetailsMarkerControl.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/shadow/DetailsMarkerControl.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -64,7 +64,7 @@
HTMLSummaryElement* DetailsMarkerControl::summaryElement()
{
Element* element = shadowHost();
- ASSERT(!element || element->hasTagName(summaryTag));
+ ASSERT_WITH_SECURITY_IMPLICATION(!element || element->hasTagName(summaryTag));
return static_cast<HTMLSummaryElement*>(element);
}
Modified: trunk/Source/WebCore/html/shadow/HTMLContentElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/shadow/HTMLContentElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/shadow/HTMLContentElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -106,7 +106,7 @@
inline HTMLContentElement* toHTMLContentElement(Node* node)
{
- ASSERT(!node || isHTMLContentElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLContentElement(node));
return static_cast<HTMLContentElement*>(node);
}
Modified: trunk/Source/WebCore/html/shadow/HTMLShadowElement.h (145398 => 145399)
--- trunk/Source/WebCore/html/shadow/HTMLShadowElement.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/shadow/HTMLShadowElement.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -60,13 +60,13 @@
inline HTMLShadowElement* toHTMLShadowElement(Node* node)
{
- ASSERT(!node || isHTMLShadowElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLShadowElement(node));
return static_cast<HTMLShadowElement*>(node);
}
inline const HTMLShadowElement* toHTMLShadowElement(const Node* node)
{
- ASSERT(!node || isHTMLShadowElement(node));
+ ASSERT_WITH_SECURITY_IMPLICATION(!node || isHTMLShadowElement(node));
return static_cast<const HTMLShadowElement*>(node);
}
Modified: trunk/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp (145398 => 145399)
--- trunk/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -127,7 +127,7 @@
{
// TextFieldDecorationElement is created only by C++ code, and it is always
// in <input> shadow.
- ASSERT(!shadowHost() || shadowHost()->hasTagName(inputTag));
+ ASSERT_WITH_SECURITY_IMPLICATION(!shadowHost() || shadowHost()->hasTagName(inputTag));
return static_cast<HTMLInputElement*>(shadowHost());
}
Modified: trunk/Source/WebCore/page/DOMWindow.cpp (145398 => 145399)
--- trunk/Source/WebCore/page/DOMWindow.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/page/DOMWindow.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -1323,7 +1323,7 @@
Document* DOMWindow::document() const
{
ScriptExecutionContext* context = ContextDestructionObserver::scriptExecutionContext();
- ASSERT(!context || context->isDocument());
+ ASSERT_WITH_SECURITY_IMPLICATION(!context || context->isDocument());
return static_cast<Document*>(context);
}
Modified: trunk/Source/WebCore/rendering/InlineTextBox.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/InlineTextBox.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/InlineTextBox.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -201,13 +201,13 @@
inline InlineTextBox* toInlineTextBox(InlineBox* inlineBox)
{
- ASSERT(!inlineBox || inlineBox->isInlineTextBox());
+ ASSERT_WITH_SECURITY_IMPLICATION(!inlineBox || inlineBox->isInlineTextBox());
return static_cast<InlineTextBox*>(inlineBox);
}
inline const InlineTextBox* toInlineTextBox(const InlineBox* inlineBox)
{
- ASSERT(!inlineBox || inlineBox->isInlineTextBox());
+ ASSERT_WITH_SECURITY_IMPLICATION(!inlineBox || inlineBox->isInlineTextBox());
return static_cast<const InlineTextBox*>(inlineBox);
}
Modified: trunk/Source/WebCore/rendering/RenderHTMLCanvas.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/RenderHTMLCanvas.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/RenderHTMLCanvas.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -49,7 +49,7 @@
inline RenderHTMLCanvas* toRenderHTMLCanvas(RenderObject* object)
{
- ASSERT(!object || !strcmp(object->renderName(), "RenderHTMLCanvas"));
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isCanvas());
return static_cast<RenderHTMLCanvas*>(object);
}
Modified: trunk/Source/WebCore/rendering/RenderScrollbar.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/RenderScrollbar.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/RenderScrollbar.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -89,7 +89,7 @@
inline RenderScrollbar* toRenderScrollbar(ScrollbarThemeClient* scrollbar)
{
- ASSERT(!scrollbar || scrollbar->isCustomScrollbar());
+ ASSERT_WITH_SECURITY_IMPLICATION(!scrollbar || scrollbar->isCustomScrollbar());
return static_cast<RenderScrollbar*>(scrollbar);
}
Modified: trunk/Source/WebCore/rendering/RenderTextFragment.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/RenderTextFragment.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/RenderTextFragment.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -71,13 +71,13 @@
inline RenderTextFragment* toRenderTextFragment(RenderObject* object)
{
- ASSERT(!object || toRenderText(object)->isTextFragment());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || toRenderText(object)->isTextFragment());
return static_cast<RenderTextFragment*>(object);
}
inline const RenderTextFragment* toRenderTextFragment(const RenderObject* object)
{
- ASSERT(!object || toRenderText(object)->isTextFragment());
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || toRenderText(object)->isTextFragment());
return static_cast<const RenderTextFragment*>(object);
}
Modified: trunk/Source/WebCore/rendering/mathml/RenderMathMLOperator.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/mathml/RenderMathMLOperator.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/mathml/RenderMathMLOperator.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -72,13 +72,13 @@
inline RenderMathMLOperator* toRenderMathMLOperator(RenderMathMLBlock* block)
{
- ASSERT(!block || block->isRenderMathMLOperator());
+ ASSERT_WITH_SECURITY_IMPLICATION(!block || block->isRenderMathMLOperator());
return static_cast<RenderMathMLOperator*>(block);
}
inline const RenderMathMLOperator* toRenderMathMLOperator(const RenderMathMLBlock* block)
{
- ASSERT(!block || block->isRenderMathMLOperator());
+ ASSERT_WITH_SECURITY_IMPLICATION(!block || block->isRenderMathMLOperator());
return static_cast<const RenderMathMLOperator*>(block);
}
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGTextPath.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/svg/RenderSVGTextPath.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGTextPath.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -45,7 +45,7 @@
inline RenderSVGTextPath* toRenderSVGTextPath(RenderObject* object)
{
- ASSERT(!object || !strcmp(object->renderName(), "RenderSVGTextPath"));
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isSVGTextPath());
return static_cast<RenderSVGTextPath*>(object);
}
Modified: trunk/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h (145398 => 145399)
--- trunk/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -63,13 +63,13 @@
inline RenderSVGViewportContainer* toRenderSVGViewportContainer(RenderObject* object)
{
- ASSERT(!object || !strcmp(object->renderName(), "RenderSVGViewportContainer"));
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || !object->isSVGViewportContainer());
return static_cast<RenderSVGViewportContainer*>(object);
}
inline const RenderSVGViewportContainer* toRenderSVGViewportContainer(const RenderObject* object)
{
- ASSERT(!object || !strcmp(object->renderName(), "RenderSVGViewportContainer"));
+ ASSERT_WITH_SECURITY_IMPLICATION(!object || !object->isSVGViewportContainer());
return static_cast<const RenderSVGViewportContainer*>(object);
}
Modified: trunk/Source/WebCore/svg/graphics/SVGImageChromeClient.h (145398 => 145399)
--- trunk/Source/WebCore/svg/graphics/SVGImageChromeClient.h 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebCore/svg/graphics/SVGImageChromeClient.h 2013-03-11 20:57:44 UTC (rev 145399)
@@ -64,7 +64,7 @@
inline SVGImageChromeClient* toSVGImageChromeClient(ChromeClient* client)
{
- ASSERT(!client || client->isSVGImageChromeClient());
+ ASSERT_WITH_SECURITY_IMPLICATION(!client || client->isSVGImageChromeClient());
return static_cast<SVGImageChromeClient*>(client);
}
Modified: trunk/Source/WebKit/chromium/ChangeLog (145398 => 145399)
--- trunk/Source/WebKit/chromium/ChangeLog 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebKit/chromium/ChangeLog 2013-03-11 20:57:44 UTC (rev 145399)
@@ -1,3 +1,13 @@
+2013-03-11 Abhishek Arya <[email protected]>
+
+ Add ASSERT_WITH_SECURITY_IMPLICATION to catch bad casts.
+ https://bugs.webkit.org/show_bug.cgi?id=112060
+
+ Reviewed by Eric Seidel.
+
+ * src/FrameLoaderClientImpl.cpp:
+ (WebKit::FrameLoaderClientImpl::redirectDataToPlugin):
+
2013-03-11 Sheriff Bot <[email protected]>
Unreviewed, rolling out r145375.
Modified: trunk/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp (145398 => 145399)
--- trunk/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp 2013-03-11 20:53:47 UTC (rev 145398)
+++ trunk/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp 2013-03-11 20:57:44 UTC (rev 145399)
@@ -1528,7 +1528,7 @@
// (e.g., acrobat reader).
void FrameLoaderClientImpl::redirectDataToPlugin(Widget* pluginWidget)
{
- ASSERT(!pluginWidget || pluginWidget->isPluginContainer());
+ ASSERT_WITH_SECURITY_IMPLICATION(!pluginWidget || pluginWidget->isPluginContainer());
m_pluginWidget = static_cast<WebPluginContainerImpl*>(pluginWidget);
}
