Title: [184164] releases/WebKitGTK/webkit-2.8
- Revision
- 184164
- Author
- [email protected]
- Date
- 2015-05-12 00:57:04 -0700 (Tue, 12 May 2015)
Log Message
Merge r183706 - Reproducible crash removing name attribute from <img> node
<https://webkit.org/b/144371>
<rdar://problem/17198583>
Reviewed by Darin Adler.
Source/WebCore:
The problem here was with HTMLImageElement::getNameAttribute(), which relies
on Element::hasName() to avoid slow attribute lookups when the attribute
is already known not to be present. Unfortunately hasName() uses an ElementData
flag that wasn't getting updated until after the call to parseAttribute().
This patch fixes the issue by moving the code that updates the hasName() flag
before the parseAttribute() virtual dispatch.
Test: fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html
* dom/Element.cpp:
(WebCore::Element::attributeChanged):
LayoutTests:
* fast/dom/HTMLImageElement/remove-name-id-attribute-from-image-expected.txt: Added.
* fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (184163 => 184164)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-12 07:55:54 UTC (rev 184163)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-12 07:57:04 UTC (rev 184164)
@@ -1,3 +1,14 @@
+2015-05-01 Andreas Kling <[email protected]>
+
+ Reproducible crash removing name attribute from <img> node
+ <https://webkit.org/b/144371>
+ <rdar://problem/17198583>
+
+ Reviewed by Darin Adler.
+
+ * fast/dom/HTMLImageElement/remove-name-id-attribute-from-image-expected.txt: Added.
+ * fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html: Added.
+
2015-04-30 Brady Eidson <[email protected]>
_javascript_ using WebSQL can create their own WebKit info table.
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/remove-name-id-attribute-from-image-expected.txt (0 => 184164)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/remove-name-id-attribute-from-image-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/remove-name-id-attribute-from-image-expected.txt 2015-05-12 07:57:04 UTC (rev 184164)
@@ -0,0 +1,14 @@
+This test checks that there's no crash when removing the name or id attribute from a HTMLImageElement.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS doc.body.firstChild.getAttribute('name') is 'bar'
+PASS doc.body.firstChild.getAttribute('id') is 'foo'
+Removing name and id attributes...
+PASS doc.body.firstChild.getAttribute('name') is null
+PASS doc.body.firstChild.getAttribute('id') is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html (0 => 184164)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html 2015-05-12 07:57:04 UTC (rev 184164)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src=""
+</head>
+<body>
+<script>
+
+description("This test checks that there's no crash when removing the name or id attribute from a HTMLImageElement.");
+
+var doc = document.implementation.createHTMLDocument( '' );
+doc.body.innerHTML = '<img name="bar" id="foo">';
+shouldBe("doc.body.firstChild.getAttribute('name')", "'bar'");
+shouldBe("doc.body.firstChild.getAttribute('id')", "'foo'");
+debug("Removing name and id attributes...");
+doc.body.firstChild.removeAttribute("name");
+doc.body.firstChild.removeAttribute("id");
+shouldBe("doc.body.firstChild.getAttribute('name')", "null");
+shouldBe("doc.body.firstChild.getAttribute('id')", "null");
+
+</script>
+<script src=""
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184163 => 184164)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 07:55:54 UTC (rev 184163)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 07:57:04 UTC (rev 184164)
@@ -1,3 +1,24 @@
+2015-05-01 Andreas Kling <[email protected]>
+
+ Reproducible crash removing name attribute from <img> node
+ <https://webkit.org/b/144371>
+ <rdar://problem/17198583>
+
+ Reviewed by Darin Adler.
+
+ The problem here was with HTMLImageElement::getNameAttribute(), which relies
+ on Element::hasName() to avoid slow attribute lookups when the attribute
+ is already known not to be present. Unfortunately hasName() uses an ElementData
+ flag that wasn't getting updated until after the call to parseAttribute().
+
+ This patch fixes the issue by moving the code that updates the hasName() flag
+ before the parseAttribute() virtual dispatch.
+
+ Test: fast/dom/HTMLImageElement/remove-name-id-attribute-from-image.html
+
+ * dom/Element.cpp:
+ (WebCore::Element::attributeChanged):
+
2015-05-01 Dan Bernstein <[email protected]>
WebCore part of <rdar://problem/8636045> Back/forward navigation to an error page in Safari breaks the back-forward list
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Element.cpp (184163 => 184164)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Element.cpp 2015-05-12 07:55:54 UTC (rev 184163)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Element.cpp 2015-05-12 07:57:04 UTC (rev 184164)
@@ -1074,37 +1074,41 @@
void Element::attributeChanged(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue, AttributeModificationReason)
{
- parseAttribute(name, newValue);
+ bool valueIsSameAsBefore = oldValue == newValue;
- document().incDOMTreeVersion();
-
- if (oldValue == newValue)
- return;
-
StyleResolver* styleResolver = document().styleResolverIfExists();
bool testShouldInvalidateStyle = inRenderedDocument() && styleResolver && styleChangeType() < FullStyleChange;
+
bool shouldInvalidateStyle = false;
- if (name == HTMLNames::idAttr) {
- if (!oldValue.isEmpty())
- treeScope().idTargetObserverRegistry().notifyObservers(*oldValue.impl());
- if (!newValue.isEmpty())
- treeScope().idTargetObserverRegistry().notifyObservers(*newValue.impl());
+ if (!valueIsSameAsBefore) {
+ if (name == HTMLNames::idAttr) {
+ if (!oldValue.isEmpty())
+ treeScope().idTargetObserverRegistry().notifyObservers(*oldValue.impl());
+ if (!newValue.isEmpty())
+ treeScope().idTargetObserverRegistry().notifyObservers(*newValue.impl());
- AtomicString oldId = elementData()->idForStyleResolution();
- AtomicString newId = makeIdForStyleResolution(newValue, document().inQuirksMode());
- if (newId != oldId) {
- elementData()->setIdForStyleResolution(newId);
- shouldInvalidateStyle = testShouldInvalidateStyle && checkNeedsStyleInvalidationForIdChange(oldId, newId, styleResolver);
- }
- } else if (name == classAttr)
- classAttributeChanged(newValue);
- else if (name == HTMLNames::nameAttr)
- elementData()->setHasNameAttribute(!newValue.isNull());
- else if (name == HTMLNames::pseudoAttr)
- shouldInvalidateStyle |= testShouldInvalidateStyle && isInShadowTree();
+ AtomicString oldId = elementData()->idForStyleResolution();
+ AtomicString newId = makeIdForStyleResolution(newValue, document().inQuirksMode());
+ if (newId != oldId) {
+ elementData()->setIdForStyleResolution(newId);
+ shouldInvalidateStyle = testShouldInvalidateStyle && checkNeedsStyleInvalidationForIdChange(oldId, newId, styleResolver);
+ }
+ } else if (name == classAttr)
+ classAttributeChanged(newValue);
+ else if (name == HTMLNames::nameAttr)
+ elementData()->setHasNameAttribute(!newValue.isNull());
+ else if (name == HTMLNames::pseudoAttr)
+ shouldInvalidateStyle |= testShouldInvalidateStyle && isInShadowTree();
+ }
+ parseAttribute(name, newValue);
+ document().incDOMTreeVersion();
+
+ if (valueIsSameAsBefore)
+ return;
+
invalidateNodeListAndCollectionCachesInAncestors(&name, this);
// If there is currently no StyleResolver, we can't be sure that this attribute change won't affect style.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
