Changeset 167569 in webkit

Timestamp:

Apr 20, 2014, 12:02:13 PM (12 years ago)

Author:

ap@apple.com

Message:

Crashes in HTMLFormElement::submit.
​https://bugs.webkit.org/show_bug.cgi?id=131910
<rdar://problem/15661790>

Source/WebCore:
Based on a patch by Kent Tamura.

Reviewed by Anders Carlsson.

Tests: fast/forms/form-submission-crash-2.html

fast/forms/form-submission-crash.html

Code that executes arbitrary JS needs to protect objects that it uses afterwards.

• html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::prepareForSubmission):
(WebCore::HTMLFormElement::submit):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::submitForm):

LayoutTests:
Reviewed by Anders Carlsson.

• fast/forms/form-submission-crash-2-expected.txt: Added.
• fast/forms/form-submission-crash-2.html: Added.
• fast/forms/form-submission-crash-expected.txt: Added.
• fast/forms/form-submission-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/form-submission-crash-2-expected.txt (added)
• LayoutTests/fast/forms/form-submission-crash-2.html (added)
• LayoutTests/fast/forms/form-submission-crash-expected.txt (added)
• LayoutTests/fast/forms/form-submission-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLFormElement.cpp (modified) (2 diffs)
• Source/WebCore/loader/FrameLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-04-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Crashes in HTMLFormElement::submit.
+        https://bugs.webkit.org/show_bug.cgi?id=131910
+        <rdar://problem/15661790>
+
+        Reviewed by Anders Carlsson.
+
+        * fast/forms/form-submission-crash-2-expected.txt: Added.
+        * fast/forms/form-submission-crash-2.html: Added.
+        * fast/forms/form-submission-crash-expected.txt: Added.
+        * fast/forms/form-submission-crash.html: Added.
+
 2014-04-20  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-04-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Crashes in HTMLFormElement::submit.
+        https://bugs.webkit.org/show_bug.cgi?id=131910
+        <rdar://problem/15661790>
+
+        Based on a patch by Kent Tamura.
+
+        Reviewed by Anders Carlsson.
+
+        Tests: fast/forms/form-submission-crash-2.html
+               fast/forms/form-submission-crash.html
+
+        Code that executes arbitrary JS needs to protect objects that it uses afterwards.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareForSubmission):
+        (WebCore::HTMLFormElement::submit):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+
 2014-04-20  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/html/HTMLFormElement.cpp

@@ -281 +281 @@
     frame->loader().client().dispatchWillSendSubmitEvent(formState.release());
 
+    Ref<HTMLFormElement> protect(*this);
     // Event handling can result in m_shouldSubmit becoming true, regardless of dispatchEvent() return value.
     if (dispatchEvent(Event::create(eventNames().submitEvent, true, true)))
@@ -353 +354 @@
 
     LockHistory lockHistory = processingUserGesture ? LockHistory::No : LockHistory::Yes;
+    Ref<HTMLFormElement> protect(*this); // Form submission can execute arbitary JavaScript.
     frame->loader().submitForm(FormSubmission::create(this, m_attributes, event, lockHistory, formSubmissionTrigger));
 

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -379 +379 @@
             return;
         m_isExecutingJavaScriptFormAction = true;
+        Ref<Frame> protect(m_frame);
         m_frame.script().executeIfJavaScriptURL(submission->action(), DoNotReplaceDocumentIfJavaScriptURL);
         m_isExecutingJavaScriptFormAction = false;