Title: [179597] trunk
- Revision
- 179597
- Author
- [email protected]
- Date
- 2015-02-03 23:01:23 -0800 (Tue, 03 Feb 2015)
Log Message
Crash when printing snapshotted plugins
https://bugs.webkit.org/show_bug.cgi?id=141212
Reviewed by Simon Fraser.
Source/WebCore:
Test: plugins/snapshotting/print-snapshotted-plugin.html
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::childShouldCreateRenderer): New
method. If the current renderer is a snapshotted plugin, only
allow children to create renderers if they are part of the
snapshot shadow dom. Otherwise RenderEmbeddedObject invariants
will be violated. This DOM class can have many other renderers, but they
can just follow their own rules.
(WebCore::HTMLPlugInImageElement::partOfSnapshotOverlay): Make this
const-correct, and don't create UA shadow DOM as a side effect if it doesn't
already exist.
* html/HTMLPlugInImageElement.h:
LayoutTests:
This test would crash without the fix due to a bad cast to RenderBox. <object>
is not prepared to have rendered inline children when rendering a plugin.
* plugins/snapshotting/print-snapshotted-plugin-expected.txt: Added.
* plugins/snapshotting/print-snapshotted-plugin.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (179596 => 179597)
--- trunk/LayoutTests/ChangeLog 2015-02-04 06:51:46 UTC (rev 179596)
+++ trunk/LayoutTests/ChangeLog 2015-02-04 07:01:23 UTC (rev 179597)
@@ -1,3 +1,16 @@
+2015-02-03 Maciej Stachowiak <[email protected]>
+
+ Crash when printing snapshotted plugins
+ https://bugs.webkit.org/show_bug.cgi?id=141212
+
+ Reviewed by Simon Fraser.
+
+ This test would crash without the fix due to a bad cast to RenderBox. <object>
+ is not prepared to have rendered inline children when rendering a plugin.
+
+ * plugins/snapshotting/print-snapshotted-plugin-expected.txt: Added.
+ * plugins/snapshotting/print-snapshotted-plugin.html: Added.
+
2015-02-03 Brent Fulgham <[email protected]>
[Win] Unreviewed. Activate more tests.
Added: trunk/LayoutTests/plugins/snapshotting/print-snapshotted-plugin-expected.txt (0 => 179597)
--- trunk/LayoutTests/plugins/snapshotting/print-snapshotted-plugin-expected.txt (rev 0)
+++ trunk/LayoutTests/plugins/snapshotting/print-snapshotted-plugin-expected.txt 2015-02-04 07:01:23 UTC (rev 179597)
@@ -0,0 +1 @@
+This test checks that printing a snapshotted plugin with text children does not crash or cause assertion failures.
Added: trunk/LayoutTests/plugins/snapshotting/print-snapshotted-plugin.html (0 => 179597)
--- trunk/LayoutTests/plugins/snapshotting/print-snapshotted-plugin.html (rev 0)
+++ trunk/LayoutTests/plugins/snapshotting/print-snapshotted-plugin.html 2015-02-04 07:01:23 UTC (rev 179597)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+ internals.settings.setPlugInSnapshottingEnabled(true);
+ internals.settings.setMaximumPlugInSnapshotAttempts(0);
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+}
+</script>
+
+This test checks that printing a snapshotted plugin with text children
+does not crash or cause assertion failures.
+
+<object id="foo" type="application/x-shockwave-flash" data=""
+ </object>
+
+<script>
+function boom()
+{
+ if (window.testRunner) {
+ testRunner.setPrinting();
+ testRunner.notifyDone();
+ } else {
+ window.print();
+ }
+}
+setTimeout(boom, 3000);
+</script>
+
Modified: trunk/Source/WebCore/ChangeLog (179596 => 179597)
--- trunk/Source/WebCore/ChangeLog 2015-02-04 06:51:46 UTC (rev 179596)
+++ trunk/Source/WebCore/ChangeLog 2015-02-04 07:01:23 UTC (rev 179597)
@@ -1,3 +1,24 @@
+2015-02-03 Maciej Stachowiak <[email protected]>
+
+ Crash when printing snapshotted plugins
+ https://bugs.webkit.org/show_bug.cgi?id=141212
+
+ Reviewed by Simon Fraser.
+
+ Test: plugins/snapshotting/print-snapshotted-plugin.html
+
+ * html/HTMLPlugInImageElement.cpp:
+ (WebCore::HTMLPlugInImageElement::childShouldCreateRenderer): New
+ method. If the current renderer is a snapshotted plugin, only
+ allow children to create renderers if they are part of the
+ snapshot shadow dom. Otherwise RenderEmbeddedObject invariants
+ will be violated. This DOM class can have many other renderers, but they
+ can just follow their own rules.
+ (WebCore::HTMLPlugInImageElement::partOfSnapshotOverlay): Make this
+ const-correct, and don't create UA shadow DOM as a side effect if it doesn't
+ already exist.
+ * html/HTMLPlugInImageElement.h:
+
2015-02-03 Chris Dumez <[email protected]>
Regression(r179584): Assertion hit in toResourceLoadPriority() on Yosemite
Modified: trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp (179596 => 179597)
--- trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp 2015-02-04 06:51:46 UTC (rev 179596)
+++ trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp 2015-02-04 07:01:23 UTC (rev 179597)
@@ -221,6 +221,14 @@
return HTMLPlugInElement::createElementRenderer(WTF::move(style));
}
+bool HTMLPlugInImageElement::childShouldCreateRenderer(const Node& child) const
+{
+ if (is<RenderSnapshottedPlugIn>(renderer()) && !partOfSnapshotOverlay(&child))
+ return false;
+
+ return HTMLPlugInElement::childShouldCreateRenderer(child);
+}
+
bool HTMLPlugInImageElement::willRecalcStyle(Style::Change change)
{
// Make sure style recalcs scheduled by a child shadow tree don't trigger reconstruction and cause flicker.
@@ -396,10 +404,13 @@
JSC::call(exec, overlay, callType, callData, globalObject, argList);
}
-bool HTMLPlugInImageElement::partOfSnapshotOverlay(Node* node)
+bool HTMLPlugInImageElement::partOfSnapshotOverlay(const Node* node) const
{
DEPRECATED_DEFINE_STATIC_LOCAL(AtomicString, selector, (".snapshot-overlay", AtomicString::ConstructFromLiteral));
- RefPtr<Element> snapshotLabel = ensureUserAgentShadowRoot().querySelector(selector, ASSERT_NO_EXCEPTION);
+ ShadowRoot* shadow = userAgentShadowRoot();
+ if (!shadow)
+ return false;
+ RefPtr<Element> snapshotLabel = shadow->querySelector(selector, ASSERT_NO_EXCEPTION);
return node && snapshotLabel && (node == snapshotLabel.get() || node->isDescendantOf(snapshotLabel.get()));
}
Modified: trunk/Source/WebCore/html/HTMLPlugInImageElement.h (179596 => 179597)
--- trunk/Source/WebCore/html/HTMLPlugInImageElement.h 2015-02-04 06:51:46 UTC (rev 179596)
+++ trunk/Source/WebCore/html/HTMLPlugInImageElement.h 2015-02-04 07:01:23 UTC (rev 179597)
@@ -77,7 +77,7 @@
void subframeLoaderDidCreatePlugIn(const Widget&);
WEBCORE_EXPORT void setIsPrimarySnapshottedPlugIn(bool);
- bool partOfSnapshotOverlay(Node*);
+ bool partOfSnapshotOverlay(const Node*) const;
bool needsCheckForSizeChange() const { return m_needsCheckForSizeChange; }
void setNeedsCheckForSizeChange() { m_needsCheckForSizeChange = true; }
@@ -118,6 +118,7 @@
virtual void didAddUserAgentShadowRoot(ShadowRoot*) override final;
virtual RenderPtr<RenderElement> createElementRenderer(Ref<RenderStyle>&&) override;
+ virtual bool childShouldCreateRenderer(const Node&) const override;
virtual bool willRecalcStyle(Style::Change) override final;
virtual void didAttachRenderers() override final;
virtual void willDetachRenderers() override final;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
