Diff
Modified: trunk/LayoutTests/ChangeLog (167568 => 167569)
--- trunk/LayoutTests/ChangeLog 2014-04-20 17:43:54 UTC (rev 167568)
+++ trunk/LayoutTests/ChangeLog 2014-04-20 19:02:13 UTC (rev 167569)
@@ -1,3 +1,16 @@
+2014-04-19 Alexey Proskuryakov <[email protected]>
+
+ Crashes in HTMLFormElement::submit.
+ https://bugs.webkit.org/show_bug.cgi?id=131910
+ <rdar://problem/15661790>
+
+ Reviewed by Anders Carlsson.
+
+ * fast/forms/form-submission-crash-2-expected.txt: Added.
+ * fast/forms/form-submission-crash-2.html: Added.
+ * fast/forms/form-submission-crash-expected.txt: Added.
+ * fast/forms/form-submission-crash.html: Added.
+
2014-04-20 Antti Koivisto <[email protected]>
Text bounding box computation for simple line layout is wrong
Added: trunk/LayoutTests/fast/forms/form-submission-crash-2-expected.txt (0 => 167569)
--- trunk/LayoutTests/fast/forms/form-submission-crash-2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/form-submission-crash-2-expected.txt 2014-04-20 19:02:13 UTC (rev 167569)
@@ -0,0 +1,5 @@
+PASS if not crashed.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/forms/form-submission-crash-2-expected.txt
___________________________________________________________________
Added: svn:mime-type
Added: svn:eol-style
Added: trunk/LayoutTests/fast/forms/form-submission-crash-2.html (0 => 167569)
--- trunk/LayoutTests/fast/forms/form-submission-crash-2.html (rev 0)
+++ trunk/LayoutTests/fast/forms/form-submission-crash-2.html 2014-04-20 19:02:13 UTC (rev 167569)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<script>
+jsTestIsAsync = true;
+var form1;
+var submit1;
+
+function start() {
+ form1 = document.createElement('form');
+ submit1 = document.createElement('input');
+ submit1.type = 'submit';
+ form1.action = '';
+ form1.appendChild(submit1);
+ setTimeout(function() {
+ submit1.click();
+ testPassed('if not crashed.');
+ finishJSTest();
+ }, 0);
+}
+
+function crash() {
+ form1.removeChild(submit1);
+ form1 = null;
+ gc();
+}
+window._onload_ = start;
+</script>
+<script src=""
+</body>
Property changes on: trunk/LayoutTests/fast/forms/form-submission-crash-2.html
___________________________________________________________________
Added: svn:mime-type
Added: trunk/LayoutTests/fast/forms/form-submission-crash-expected.txt (0 => 167569)
--- trunk/LayoutTests/fast/forms/form-submission-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/form-submission-crash-expected.txt 2014-04-20 19:02:13 UTC (rev 167569)
@@ -0,0 +1,5 @@
+PASS if not crashed.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/forms/form-submission-crash-expected.txt
___________________________________________________________________
Added: svn:mime-type
Added: svn:eol-style
Added: trunk/LayoutTests/fast/forms/form-submission-crash.html (0 => 167569)
--- trunk/LayoutTests/fast/forms/form-submission-crash.html (rev 0)
+++ trunk/LayoutTests/fast/forms/form-submission-crash.html 2014-04-20 19:02:13 UTC (rev 167569)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<script>
+jsTestIsAsync = true;
+var form1;
+var submit1;
+
+function start() {
+ form1 = document.createElement('form');
+ submit1 = document.createElement('input');
+ submit1.type = 'submit';
+ form1.addEventListener('submit', handleSubmit, false);
+ form1.action = '';
+ form1.appendChild(submit1);
+ setTimeout(function() {
+ submit1.click();
+ testPassed('if not crashed.');
+ finishJSTest();
+ }, 0);
+}
+
+function handleSubmit() {
+ form1.removeChild(submit1);
+ form1 = null;
+}
+window._onload_ = start;
+</script>
+<script src=""
+</body>
Property changes on: trunk/LayoutTests/fast/forms/form-submission-crash.html
___________________________________________________________________
Added: svn:mime-type
Modified: trunk/Source/WebCore/ChangeLog (167568 => 167569)
--- trunk/Source/WebCore/ChangeLog 2014-04-20 17:43:54 UTC (rev 167568)
+++ trunk/Source/WebCore/ChangeLog 2014-04-20 19:02:13 UTC (rev 167569)
@@ -1,3 +1,24 @@
+2014-04-19 Alexey Proskuryakov <[email protected]>
+
+ Crashes in HTMLFormElement::submit.
+ https://bugs.webkit.org/show_bug.cgi?id=131910
+ <rdar://problem/15661790>
+
+ Based on a patch by Kent Tamura.
+
+ Reviewed by Anders Carlsson.
+
+ Tests: fast/forms/form-submission-crash-2.html
+ fast/forms/form-submission-crash.html
+
+ Code that executes arbitrary JS needs to protect objects that it uses afterwards.
+
+ * html/HTMLFormElement.cpp:
+ (WebCore::HTMLFormElement::prepareForSubmission):
+ (WebCore::HTMLFormElement::submit):
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::submitForm):
+
2014-04-20 Antti Koivisto <[email protected]>
Text bounding box computation for simple line layout is wrong
Modified: trunk/Source/WebCore/html/HTMLFormElement.cpp (167568 => 167569)
--- trunk/Source/WebCore/html/HTMLFormElement.cpp 2014-04-20 17:43:54 UTC (rev 167568)
+++ trunk/Source/WebCore/html/HTMLFormElement.cpp 2014-04-20 19:02:13 UTC (rev 167569)
@@ -280,6 +280,7 @@
RefPtr<FormState> formState = FormState::create(this, controlNamesAndValues, &document(), NotSubmittedByJavaScript);
frame->loader().client().dispatchWillSendSubmitEvent(formState.release());
+ Ref<HTMLFormElement> protect(*this);
// Event handling can result in m_shouldSubmit becoming true, regardless of dispatchEvent() return value.
if (dispatchEvent(Event::create(eventNames().submitEvent, true, true)))
m_shouldSubmit = true;
@@ -352,6 +353,7 @@
firstSuccessfulSubmitButton->setActivatedSubmit(true);
LockHistory lockHistory = processingUserGesture ? LockHistory::No : LockHistory::Yes;
+ Ref<HTMLFormElement> protect(*this); // Form submission can execute arbitary _javascript_.
frame->loader().submitForm(FormSubmission::create(this, m_attributes, event, lockHistory, formSubmissionTrigger));
if (needButtonActivation && firstSuccessfulSubmitButton)
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (167568 => 167569)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2014-04-20 17:43:54 UTC (rev 167568)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2014-04-20 19:02:13 UTC (rev 167569)
@@ -378,6 +378,7 @@
if (!m_frame.document()->contentSecurityPolicy()->allowFormAction(URL(submission->action())))
return;
m_isExecutingJavaScriptFormAction = true;
+ Ref<Frame> protect(m_frame);
m_frame.script().executeIfJavaScriptURL(submission->action(), DoNotReplaceDocumentIfJavaScriptURL);
m_isExecutingJavaScriptFormAction = false;
return;
