Changeset 140049 in webkit


Ignore:
Timestamp:
Jan 17, 2013, 2:51:03 PM (13 years ago)
Author:
schenney@chromium.org
Message:

SVGViewSpec fails when corresponding element has been removed
​https://bugs.webkit.org/show_bug.cgi?id=106957

Reviewed by Dirk Schulze.

Source/WebCore:

When JS holds an SVGViewSpec object while deleting the object that
defines the spec (an SVGSVGElement, or one of a few others) the
pointer to the target is cleared in the SVGViewSpec but the methods
that serve JS queries do not check and try to access the now null
target. This atch fixes the prooblem, throwing JS exceptions where
possible and returning null where necessary.

Test: svg/dom/SVGViewSpec-invalid-ref-crash.html

  • svg/SVGViewSpec.cpp:

(WebCore):
(WebCore::SVGViewSpec::viewTarget): Check for null target and throw an exception.
(WebCore::SVGViewSpec::transform): Check for null target and return
null. It is not possible to throw an exception here because it leads
to an invalid cast in the code generated from IDLs.
(WebCore::SVGViewSpec::viewBoxAnimated): Check for null target and throw an exception.
(WebCore::SVGViewSpec::preserveAspectRatioAnimated): Check for null target and throw an exception.
(WebCore::SVGViewSpec::lookupOrCreateViewBoxWrapper): ASSERT non-null target
(WebCore::SVGViewSpec::lookupOrCreatePreserveAspectRatioWrapper): ASSERT non-null target
(WebCore::SVGViewSpec::lookupOrCreateTransformWrapper): ASSERT non-null target

  • svg/SVGViewSpec.h:

(SVGViewSpec): Add Exception arguments to getter methods.

  • svg/SVGViewSpec.idl: Mark attributes as throwing exceptions.

LayoutTests:

Test for the situation in which the target of an SVGViewSpec is
removed while the view spec lives on in JS.

  • svg/dom/SVGViewSpec-invalid-ref-crash-expected.txt: Added.
  • svg/dom/SVGViewSpec-invalid-ref-crash.html: Added.
Location:
trunk
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r140045 r140049  
     12013-01-17  Stephen Chenney  <schenney@chromium.org>
     2
     3        SVGViewSpec fails when corresponding element has been removed
     4        https://bugs.webkit.org/show_bug.cgi?id=106957
     5
     6        Reviewed by Dirk Schulze.
     7
     8        Test for the situation in which the target of an SVGViewSpec is
     9        removed while the view spec lives on in JS.
     10
     11        * svg/dom/SVGViewSpec-invalid-ref-crash-expected.txt: Added.
     12        * svg/dom/SVGViewSpec-invalid-ref-crash.html: Added.
     13
    1142013-01-17  Julien Chaffraix  <jchaffraix@webkit.org>
    215

  • trunk/Source/WebCore/ChangeLog

    r140048 r140049  
     12013-01-17  Stephen Chenney  <schenney@chromium.org>
     2
     3        SVGViewSpec fails when corresponding element has been removed
     4        https://bugs.webkit.org/show_bug.cgi?id=106957
     5
     6        Reviewed by Dirk Schulze.
     7
     8        When JS holds an SVGViewSpec object while deleting the object that
     9        defines the spec (an SVGSVGElement, or one of a few others) the
     10        pointer to the target is cleared in the SVGViewSpec but the methods
     11        that serve JS queries do not check and try to access the now null
     12        target. This atch fixes the prooblem, throwing JS exceptions where
     13        possible and returning null where necessary.
     14
     15        Test: svg/dom/SVGViewSpec-invalid-ref-crash.html
     16
     17        * svg/SVGViewSpec.cpp:
     18        (WebCore):
     19        (WebCore::SVGViewSpec::viewTarget): Check for null target and throw an exception.
     20        (WebCore::SVGViewSpec::transform): Check for null target and return
     21        null. It is not possible to throw an exception here because it leads
     22        to an invalid cast in the code generated from IDLs.
     23        (WebCore::SVGViewSpec::viewBoxAnimated): Check for null target and throw an exception.
     24        (WebCore::SVGViewSpec::preserveAspectRatioAnimated): Check for null target and throw an exception.
     25        (WebCore::SVGViewSpec::lookupOrCreateViewBoxWrapper): ASSERT non-null target
     26        (WebCore::SVGViewSpec::lookupOrCreatePreserveAspectRatioWrapper): ASSERT non-null target
     27        (WebCore::SVGViewSpec::lookupOrCreateTransformWrapper): ASSERT non-null target
     28        * svg/SVGViewSpec.h:
     29        (SVGViewSpec): Add Exception arguments to getter methods.
     30        * svg/SVGViewSpec.idl: Mark attributes as throwing exceptions.
     31
    1322013-01-17  Alec Flett  <alecflett@chromium.org>
    233

  • trunk/Source/WebCore/svg/SVGViewSpec.cpp

    r133976 r140049  
    134134}
    135135
    136 void SVGViewSpec::setPreserveAspectRatioString(const String& preserve)
    137 {
    138     SVGPreserveAspectRatio preserveAspectRatio;
    139     preserveAspectRatio.parse(preserve);
    140     setPreserveAspectRatioBaseValue(preserveAspectRatio);
    141 }
    142 
    143136String SVGViewSpec::preserveAspectRatioString() const
    144137{
    … …  
    146139}
    147140
    148 SVGElement* SVGViewSpec::viewTarget() const
     141SVGElement* SVGViewSpec::viewTarget(ExceptionCode& ec) const
     142{
     143    if (!m_contextElement) {
     144        ec = INVALID_STATE_ERR;
     145        return 0;
     146    }
     147    return static_cast<SVGElement*>(m_contextElement->treeScope()->getElementById(m_viewTargetString));
     148}
     149
     150SVGTransformListPropertyTearOff* SVGViewSpec::transform()
    149151{
    150152    if (!m_contextElement)
    151153        return 0;
    152     return static_cast<SVGElement*>(m_contextElement->treeScope()->getElementById(m_viewTargetString));
    153 }
    154 
    155 SVGTransformListPropertyTearOff* SVGViewSpec::transform()
    156 {
    157154    // Return the animVal here, as its readonly by default - which is exactly what we want here.
    158155    return static_cast<SVGTransformListPropertyTearOff*>(static_pointer_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
    159156}
    160157
     158PassRefPtr<SVGAnimatedRect> SVGViewSpec::viewBoxAnimated(ExceptionCode& ec)
     159{
     160    if (!m_contextElement) {
     161        ec = INVALID_STATE_ERR;
     162        return 0;
     163    }
     164    return static_pointer_cast<SVGAnimatedRect>(lookupOrCreateViewBoxWrapper(this));
     165}
     166
     167PassRefPtr<SVGAnimatedPreserveAspectRatio> SVGViewSpec::preserveAspectRatioAnimated(ExceptionCode& ec)
     168{
     169    if (!m_contextElement) {
     170        ec = INVALID_STATE_ERR;
     171        return 0;
     172    }
     173    return static_pointer_cast<SVGAnimatedPreserveAspectRatio>(lookupOrCreatePreserveAspectRatioWrapper(this));
     174}
     175
    161176PassRefPtr<SVGAnimatedProperty> SVGViewSpec::lookupOrCreateViewBoxWrapper(void* maskedOwnerType)
    162177{
    163178    ASSERT(maskedOwnerType);
    164179    SVGViewSpec* ownerType = static_cast<SVGViewSpec*>(maskedOwnerType);
     180    ASSERT(ownerType->contextElement());
    165181    return SVGAnimatedProperty::lookupOrCreateWrapper<SVGElement, SVGAnimatedRect, FloatRect>(ownerType->contextElement(), viewBoxPropertyInfo(), ownerType->m_viewBox);
    166182}
    … …  
    170186    ASSERT(maskedOwnerType);
    171187    SVGViewSpec* ownerType = static_cast<SVGViewSpec*>(maskedOwnerType);
     188    ASSERT(ownerType->contextElement());
    172189    return SVGAnimatedProperty::lookupOrCreateWrapper<SVGElement, SVGAnimatedPreserveAspectRatio, SVGPreserveAspectRatio>(ownerType->contextElement(), preserveAspectRatioPropertyInfo(), ownerType->m_preserveAspectRatio);
    173190}
    … …  
    177194    ASSERT(maskedOwnerType);
    178195    SVGViewSpec* ownerType = static_cast<SVGViewSpec*>(maskedOwnerType);
     196    ASSERT(ownerType->contextElement());
    179197    return SVGAnimatedProperty::lookupOrCreateWrapper<SVGElement, SVGAnimatedTransformList, SVGTransformList>(ownerType->contextElement(), transformPropertyInfo(), ownerType->m_transform);
    180198}

  • trunk/Source/WebCore/svg/SVGViewSpec.h

    r118735 r140049  
    5050    void reset();
    5151
    52     SVGElement* viewTarget() const;
     52    SVGElement* viewTarget(ExceptionCode&) const;
    5353    String viewBoxString() const;
    5454
    55     void setPreserveAspectRatioString(const String&);
    5655    String preserveAspectRatioString() const;
    5756
    … …  
    7574
    7675    // Custom animated 'viewBox' property.
    77     PassRefPtr<SVGAnimatedRect> viewBoxAnimated()
    78     {
    79         return static_pointer_cast<SVGAnimatedRect>(lookupOrCreateViewBoxWrapper(this));
    80     }
    81 
     76    PassRefPtr<SVGAnimatedRect> viewBoxAnimated(ExceptionCode&);
    8277    FloatRect& viewBox() { return m_viewBox; }
    8378    FloatRect viewBoxBaseValue() const { return m_viewBox; }
    … …  
    8580
    8681    // Custom animated 'preserveAspectRatio' property.
    87     PassRefPtr<SVGAnimatedPreserveAspectRatio> preserveAspectRatioAnimated()
    88     {
    89         return static_pointer_cast<SVGAnimatedPreserveAspectRatio>(lookupOrCreatePreserveAspectRatioWrapper(this));
    90     }
    91 
     82    PassRefPtr<SVGAnimatedPreserveAspectRatio> preserveAspectRatioAnimated(ExceptionCode&);
    9283    SVGPreserveAspectRatio& preserveAspectRatio() { return m_preserveAspectRatio; }
    9384    SVGPreserveAspectRatio preserveAspectRatioBaseValue() const { return m_preserveAspectRatio; }

  • trunk/Source/WebCore/svg/SVGViewSpec.idl

    r131172 r140049  
    3131] interface SVGViewSpec {
    3232      readonly attribute SVGTransformList transform;
    33       readonly attribute SVGElement viewTarget;
     33      readonly attribute SVGElement viewTarget
     34        getter raises(DOMException);
    3435      readonly attribute DOMString viewBoxString;
    3536      readonly attribute DOMString preserveAspectRatioString;
    … …  
    4243
    4344      // SVGFitToViewBox
    44       readonly attribute SVGAnimatedRect viewBox;
    45       readonly attribute SVGAnimatedPreserveAspectRatio preserveAspectRatio;
     45      readonly attribute SVGAnimatedRect viewBox
     46        getter raises(DOMException);
     47      readonly attribute SVGAnimatedPreserveAspectRatio preserveAspectRatio
     48        getter raises(DOMException);
    4649};
    4750
Note: See TracChangeset for help on using the changeset viewer.