Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145637 => 145638)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:43:44 UTC (rev 145637)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:43:48 UTC (rev 145638)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r136560
+
+ 2012-12-04 Abhishek Arya <[email protected]>
+
+ Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
+ https://bugs.webkit.org/show_bug.cgi?id=100621
+
+ Reviewed by Eric Seidel.
+
+ * fast/css/image-set-value-not-removed-crash-expected.txt: Added.
+ * fast/css/image-set-value-not-removed-crash.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r136558
2012-12-04 Abhishek Arya <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt (from rev 136560, trunk/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt) (0 => 145638)
--- branches/safari-536.30-branch/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/css/image-set-value-not-removed-crash-expected.txt 2013-03-13 00:43:48 UTC (rev 145638)
@@ -0,0 +1,2 @@
+PASS. WebKit didn't crash.
+
Copied: branches/safari-536.30-branch/LayoutTests/fast/css/image-set-value-not-removed-crash.html (from rev 136560, trunk/LayoutTests/fast/css/image-set-value-not-removed-crash.html) (0 => 145638)
--- branches/safari-536.30-branch/LayoutTests/fast/css/image-set-value-not-removed-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/css/image-set-value-not-removed-crash.html 2013-03-13 00:43:48 UTC (rev 145638)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+A
+<style>
+@-webkit-keyframes anim1 {
+ 0% {
+ opacity: 0.5772; border-image: 26829%;
+ }
+ 100% {
+ opacity: 0.3167;
+ }
+}
+* {
+ -webkit-animation-name: anim1;
+ -webkit-animation-duration: 1s;
+}
+.class1 {
+ border-image: -webkit-image-set(url(#does-not-exist) 25x, url("does-not-exist.gif") 206x) 2 126 158 166 fill;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var docElement = document.body;
+docElement.contentEditable = "true";
+
+function crash() {
+ test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ test1.setAttribute("class", "class1");
+ docElement.appendChild(test1);
+ document.execCommand("SelectAll", false, null)
+ document.execCommand("InsertText", false, "PASS. WebKit didn't crash.")
+ for (i = 0; i != 49; i++)
+ window.getSelection().modify("move", "forward", "character");
+
+ document.execCommand("Italic", false, null);
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>
\ No newline at end of file
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145637 => 145638)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:43:44 UTC (rev 145637)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:43:48 UTC (rev 145638)
@@ -1,5 +1,29 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r136560
+
+ 2012-12-04 Abhishek Arya <[email protected]>
+
+ Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
+ https://bugs.webkit.org/show_bug.cgi?id=100621
+
+ Reviewed by Eric Seidel.
+
+ r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
+ and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
+ a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
+ is cleared when CSSImageSetValue is going away.
+
+ Test: fast/css/image-set-value-not-removed-crash.html
+
+ * css/CSSImageSetValue.cpp:
+ (WebCore::CSSImageSetValue::~CSSImageSetValue):
+ * rendering/style/StyleCachedImageSet.h:
+ (WebCore::StyleCachedImageSet::clearImageSetValue):
+ (StyleCachedImageSet):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r136558
2012-12-04 Abhishek Arya <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/css/CSSImageSetValue.cpp (145637 => 145638)
--- branches/safari-536.30-branch/Source/WebCore/css/CSSImageSetValue.cpp 2013-03-13 00:43:44 UTC (rev 145637)
+++ branches/safari-536.30-branch/Source/WebCore/css/CSSImageSetValue.cpp 2013-03-13 00:43:48 UTC (rev 145638)
@@ -47,6 +47,8 @@
CSSImageSetValue::~CSSImageSetValue()
{
+ if (m_imageSet && m_imageSet->isCachedImageSet())
+ static_cast<StyleCachedImageSet*>(m_imageSet.get())->clearImageSetValue();
}
void CSSImageSetValue::fillImageSet()
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/style/StyleCachedImageSet.h (145637 => 145638)
--- branches/safari-536.30-branch/Source/WebCore/rendering/style/StyleCachedImageSet.h 2013-03-13 00:43:44 UTC (rev 145637)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/style/StyleCachedImageSet.h 2013-03-13 00:43:48 UTC (rev 145638)
@@ -57,6 +57,8 @@
CachedImage* cachedImage() const { return m_bestFitImage.get(); }
+ void clearImageSetValue() { m_imageSetValue = 0; }
+
virtual bool canRender(const RenderObject*, float multiplier) const;
virtual bool isLoaded() const;
virtual bool errorOccurred() const;
