Diff
Modified: branches/safari-537-branch/LayoutTests/ChangeLog (153538 => 153539)
--- branches/safari-537-branch/LayoutTests/ChangeLog 2013-07-31 19:51:49 UTC (rev 153538)
+++ branches/safari-537-branch/LayoutTests/ChangeLog 2013-07-31 19:55:08 UTC (rev 153539)
@@ -1,3 +1,21 @@
+2013-07-31 Lucas Forschler <[email protected]>
+
+ Merge r153511
+
+ 2013-07-30 Tim Horton <[email protected]>
+
+ DHTML drag can result in a null-deref under WebDragClient::startDrag
+ https://bugs.webkit.org/show_bug.cgi?id=119297
+ <rdar://problem/14213012>
+
+ Reviewed by Simon Fraser.
+
+ Add a test that ensures that using a zero-size in-document non-<img>
+ element for setDragImage() doesn't crash.
+
+ * fast/events/setDragImage-in-document-element-crash-expected.txt: Added.
+ * fast/events/setDragImage-in-document-element-crash.html: Added.
+
2013-07-28 Lucas Forschler <[email protected]>
Merge r153399
Copied: branches/safari-537-branch/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt (from rev 153511, trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt) (0 => 153539)
--- branches/safari-537-branch/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt (rev 0)
+++ branches/safari-537-branch/LayoutTests/fast/events/setDragImage-in-document-element-crash-expected.txt 2013-07-31 19:55:08 UTC (rev 153539)
@@ -0,0 +1 @@
+PASS if no crash.
Copied: branches/safari-537-branch/LayoutTests/fast/events/setDragImage-in-document-element-crash.html (from rev 153511, trunk/LayoutTests/fast/events/setDragImage-in-document-element-crash.html) (0 => 153539)
--- branches/safari-537-branch/LayoutTests/fast/events/setDragImage-in-document-element-crash.html (rev 0)
+++ branches/safari-537-branch/LayoutTests/fast/events/setDragImage-in-document-element-crash.html 2013-07-31 19:55:08 UTC (rev 153539)
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ pre {
+ width: 0;
+ height: 0;
+ }
+
+ img {
+ position: absolute;
+ top: 100px;
+ left: 100px;
+ }
+ </style>
+ <script>
+ if (!window.testRunner)
+ document.writeln("To run this test manually, attempt to drag Abe.");
+
+ function startTest() {
+ document.getElementById("abe").addEventListener("dragstart", startDrag, false);
+ if (!window.testRunner)
+ return;
+
+ testRunner.dumpAsText();
+
+ eventSender.mouseMoveTo(110, 110);
+ eventSender.mouseDown();
+ eventSender.leapForward(200);
+ eventSender.mouseMoveTo(0, 0);
+ eventSender.mouseUp();
+
+ document.body.innerHTML = "PASS if no crash."
+ }
+
+ function startDrag(event) {
+ event.dataTransfer.setData('text/plain', 'Data to Drag');
+ event.dataTransfer.setDragImage(document.getElementById("pre"), 0, 0);
+ }
+ </script>
+ <body _onload_="startTest()">
+ <img id="abe" src="" draggable="true">
+ <pre id="pre"></pre>
+ </body>
+</html>
Modified: branches/safari-537-branch/Source/WebCore/ChangeLog (153538 => 153539)
--- branches/safari-537-branch/Source/WebCore/ChangeLog 2013-07-31 19:51:49 UTC (rev 153538)
+++ branches/safari-537-branch/Source/WebCore/ChangeLog 2013-07-31 19:55:08 UTC (rev 153539)
@@ -1,3 +1,22 @@
+2013-07-31 Lucas Forschler <[email protected]>
+
+ Merge r153511
+
+ 2013-07-30 Tim Horton <[email protected]>
+
+ DHTML drag can result in a null-deref under WebDragClient::startDrag
+ https://bugs.webkit.org/show_bug.cgi?id=119297
+ <rdar://problem/14213012>
+
+ Reviewed by Simon Fraser.
+
+ Test: fast/events/setDragImage-in-document-element-crash.html
+
+ * page/mac/FrameSnapshottingMac.mm:
+ (WebCore::snapshotDragImage):
+ We shouldn't waste time painting an empty image, nor should we return
+ an image with no size.
+
2013-07-29 Lucas Forschler <[email protected]>
Merge r153447
Modified: branches/safari-537-branch/Source/WebCore/page/mac/FrameSnapshottingMac.mm (153538 => 153539)
--- branches/safari-537-branch/Source/WebCore/page/mac/FrameSnapshottingMac.mm 2013-07-31 19:51:49 UTC (rev 153538)
+++ branches/safari-537-branch/Source/WebCore/page/mac/FrameSnapshottingMac.mm 2013-07-31 19:55:08 UTC (rev 153539)
@@ -143,6 +143,9 @@
LayoutRect topLevelRect;
NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
+ if (NSIsEmptyRect(paintingRect))
+ return nil;
+
frame->view()->setNodeToDraw(node); // invoke special sub-tree drawing mode
NSImage* result = imageFromRect(frame, paintingRect);
renderer->updateDragState(false);
Modified: branches/safari-537-branch/Source/WebKit2/ChangeLog (153538 => 153539)
--- branches/safari-537-branch/Source/WebKit2/ChangeLog 2013-07-31 19:51:49 UTC (rev 153538)
+++ branches/safari-537-branch/Source/WebKit2/ChangeLog 2013-07-31 19:55:08 UTC (rev 153539)
@@ -1,5 +1,21 @@
2013-07-31 Lucas Forschler <[email protected]>
+ Merge r153511
+
+ 2013-07-30 Tim Horton <[email protected]>
+
+ DHTML drag can result in a null-deref under WebDragClient::startDrag
+ https://bugs.webkit.org/show_bug.cgi?id=119297
+ <rdar://problem/14213012>
+
+ Reviewed by Simon Fraser.
+
+ * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+ (WebKit::convertImageToBitmap):
+ ShareableBitmap::createShareable can return null, but shouldn't dereference that.
+
+2013-07-31 Lucas Forschler <[email protected]>
+
Merge r153487
2013-07-30 Tim Horton <[email protected]>
Modified: branches/safari-537-branch/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm (153538 => 153539)
--- branches/safari-537-branch/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm 2013-07-31 19:51:49 UTC (rev 153538)
+++ branches/safari-537-branch/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm 2013-07-31 19:55:08 UTC (rev 153539)
@@ -61,6 +61,9 @@
static PassRefPtr<ShareableBitmap> convertImageToBitmap(NSImage *image, const IntSize& size)
{
RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(size, ShareableBitmap::SupportsAlpha);
+ if (!bitmap)
+ return nullptr;
+
OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
RetainPtr<NSGraphicsContext> savedContext = [NSGraphicsContext currentContext];
