Title: [153511] trunk
- Revision
- 153511
- Author
- [email protected]
- Date
- 2013-07-30 22:57:28 -0700 (Tue, 30 Jul 2013)
Log Message
DHTML drag can result in a null-deref under WebDragClient::startDrag
https://bugs.webkit.org/show_bug.cgi?id=119297
<rdar://problem/14213012>
Reviewed by Simon Fraser.
Test: fast/events/setDragImage-in-document-element-crash.html
* page/mac/FrameSnapshottingMac.mm:
(WebCore::snapshotDragImage):
We shouldn't waste time painting an empty image, nor should we return
an image with no size.
Add a test that ensures that using a zero-size in-document non-<img>
element for setDragImage() doesn't crash.
* fast/events/setDragImage-in-document-element-crash-expected.txt: Added.
* fast/events/setDragImage-in-document-element-crash.html: Added.
* WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
(WebKit::convertImageToBitmap):
ShareableBitmap::createShareable can return null, but shouldn't dereference that.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (153510 => 153511)
--- trunk/LayoutTests/ChangeLog 2013-07-31 04:59:52 UTC (rev 153510)
+++ trunk/LayoutTests/ChangeLog 2013-07-31 05:57:28 UTC (rev 153511)
@@ -1,3 +1,17 @@
+2013-07-30 Tim Horton <[email protected]>
+
+ DHTML drag can result in a null-deref under WebDragClient::startDrag
+ https://bugs.webkit.org/show_bug.cgi?id=119297
+ <rdar://problem/14213012>
+
+ Reviewed by Simon Fraser.
+
+ Add a test that ensures that using a zero-size in-document non-<img>
+ element for setDragImage() doesn't crash.
+
+ * fast/events/setDragImage-in-document-element-crash-expected.txt: Added.
+ * fast/events/setDragImage-in-document-element-crash.html: Added.
+
2013-07-30 Pravin D <[email protected]>
Dotted borders render w/ artifacts and sometimes as solid lines
Added: trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt (0 => 153511)
--- trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt 2013-07-31 05:57:28 UTC (rev 153511)
@@ -0,0 +1 @@
+PASS if no crash.
Added: trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash.html (0 => 153511)
--- trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash.html (rev 0)
+++ trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash.html 2013-07-31 05:57:28 UTC (rev 153511)
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ pre {
+ width: 0;
+ height: 0;
+ }
+
+ img {
+ position: absolute;
+ top: 100px;
+ left: 100px;
+ }
+ </style>
+ <script>
+ if (!window.testRunner)
+ document.writeln("To run this test manually, attempt to drag Abe.");
+
+ function startTest() {
+ document.getElementById("abe").addEventListener("dragstart", startDrag, false);
+ if (!window.testRunner)
+ return;
+
+ testRunner.dumpAsText();
+
+ eventSender.mouseMoveTo(110, 110);
+ eventSender.mouseDown();
+ eventSender.leapForward(200);
+ eventSender.mouseMoveTo(0, 0);
+ eventSender.mouseUp();
+
+ document.body.innerHTML = "PASS if no crash."
+ }
+
+ function startDrag(event) {
+ event.dataTransfer.setData('text/plain', 'Data to Drag');
+ event.dataTransfer.setDragImage(document.getElementById("pre"), 0, 0);
+ }
+ </script>
+ <body _onload_="startTest()">
+ <img id="abe" src="" draggable="true">
+ <pre id="pre"></pre>
+ </body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (153510 => 153511)
--- trunk/Source/WebCore/ChangeLog 2013-07-31 04:59:52 UTC (rev 153510)
+++ trunk/Source/WebCore/ChangeLog 2013-07-31 05:57:28 UTC (rev 153511)
@@ -1,3 +1,18 @@
+2013-07-30 Tim Horton <[email protected]>
+
+ DHTML drag can result in a null-deref under WebDragClient::startDrag
+ https://bugs.webkit.org/show_bug.cgi?id=119297
+ <rdar://problem/14213012>
+
+ Reviewed by Simon Fraser.
+
+ Test: fast/events/setDragImage-in-document-element-crash.html
+
+ * page/mac/FrameSnapshottingMac.mm:
+ (WebCore::snapshotDragImage):
+ We shouldn't waste time painting an empty image, nor should we return
+ an image with no size.
+
2013-07-30 Pravin D <[email protected]>
Dotted borders render w/ artifacts and sometimes as solid lines
Modified: trunk/Source/WebCore/page/mac/FrameSnapshottingMac.mm (153510 => 153511)
--- trunk/Source/WebCore/page/mac/FrameSnapshottingMac.mm 2013-07-31 04:59:52 UTC (rev 153510)
+++ trunk/Source/WebCore/page/mac/FrameSnapshottingMac.mm 2013-07-31 05:57:28 UTC (rev 153511)
@@ -143,6 +143,9 @@
LayoutRect topLevelRect;
NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
+ if (NSIsEmptyRect(paintingRect))
+ return nil;
+
frame->view()->setNodeToDraw(node); // invoke special sub-tree drawing mode
NSImage* result = imageFromRect(frame, paintingRect);
renderer->updateDragState(false);
Modified: trunk/Source/WebKit2/ChangeLog (153510 => 153511)
--- trunk/Source/WebKit2/ChangeLog 2013-07-31 04:59:52 UTC (rev 153510)
+++ trunk/Source/WebKit2/ChangeLog 2013-07-31 05:57:28 UTC (rev 153511)
@@ -1,3 +1,15 @@
+2013-07-30 Tim Horton <[email protected]>
+
+ DHTML drag can result in a null-deref under WebDragClient::startDrag
+ https://bugs.webkit.org/show_bug.cgi?id=119297
+ <rdar://problem/14213012>
+
+ Reviewed by Simon Fraser.
+
+ * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+ (WebKit::convertImageToBitmap):
+ ShareableBitmap::createShareable can return null, but shouldn't dereference that.
+
2013-07-30 Ruth Fong <[email protected]>
Rename <input type='color'> functions in WebPageProxy, WebColorPicker
Modified: trunk/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm (153510 => 153511)
--- trunk/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm 2013-07-31 04:59:52 UTC (rev 153510)
+++ trunk/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm 2013-07-31 05:57:28 UTC (rev 153511)
@@ -61,6 +61,9 @@
static PassRefPtr<ShareableBitmap> convertImageToBitmap(NSImage *image, const IntSize& size)
{
RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(size, ShareableBitmap::SupportsAlpha);
+ if (!bitmap)
+ return nullptr;
+
OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
RetainPtr<NSGraphicsContext> savedContext = [NSGraphicsContext currentContext];
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
