⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 185769 in webkit


Ignore:
Timestamp:
Jun 19, 2015, 2:55:55 PM (11 years ago)
Author:
aestes@apple.com
Message:

Various assertion failures occur when executing script in the midst of DOM insertion
​https://bugs.webkit.org/show_bug.cgi?id=132482

Reviewed by Darin Adler.

Source/WebCore:

Prior to this change, when an element containing a <script> child was inserted into a document, the script was
executed in ScriptElement::insertedInto(). That script can access nodes that follow it in the newly-inserted
hierarchy but are not yet fully inserted, leading to at least the following problems:

  • The script could remove a node that is not yet marked as in the document.
  • The script could remove a named <map> that has yet to be added to TreeScope::m_imageMapsByName.
  • The script could remove a form control that has yet to be added to FormController::m_formElementsWithState.

These scenarios all result in assertion failures. This change ensures that each node in the newly-inserted
hierarchy is fully inserted before executing any scripts.

Tests: fast/dom/element-removed-while-inserting-parent-crash.html

fast/dom/named-map-removed-while-inserting-parent-crash.html
fast/forms/form-control-removed-while-inserting-parent-crash.html
svg/dom/element-removed-while-inserting-parent-crash.html

  • dom/ScriptElement.cpp:

(WebCore::ScriptElement::shouldNotifySubtreeInsertions): Renamed from insertedInto().
Returned true in the case where insertedInto() would've called prepareScript().
(WebCore::ScriptElement::didNotifySubtreeInsertions): Called prepareScript().
(WebCore::ScriptElement::insertedInto): Renamed to shouldNotifySubtreeInsertions().

  • dom/ScriptElement.h:
  • html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::insertedInto): If shouldNotifySubtreeInsertions() is true, returned InsertionShouldCallDidNotifySubtreeInsertions.
Otherwise, returned InsertionDone.
(WebCore::HTMLScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

  • html/HTMLScriptElement.h:
  • svg/SVGScriptElement.cpp:

(WebCore::SVGScriptElement::insertedInto): Did the same as HTMLScriptElement::insertedInto().
(WebCore::SVGScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

  • svg/SVGScriptElement.h:

LayoutTests:

Wrote named-map-removed-while-inserting-parent-crash.html by reducing the test case attached to bug 132482.
The remaining tests were taken from blink r132482.

  • fast/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
  • fast/dom/element-removed-while-inserting-parent-crash.html: Added.
  • fast/dom/named-map-removed-while-inserting-parent-crash-expected.txt: Added.
  • fast/dom/named-map-removed-while-inserting-parent-crash.html: Added.
  • fast/forms/form-control-removed-while-inserting-parent-crash-expected.txt: Added.
  • fast/forms/form-control-removed-while-inserting-parent-crash.html: Added.
  • svg/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
  • svg/dom/element-removed-while-inserting-parent-crash.html: Added.
Location:
trunk
Files:
8 added
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r185758 r185769  
     12015-06-19  Andy Estes  <aestes@apple.com>
     2
     3        Various assertion failures occur when executing script in the midst of DOM insertion
     4        https://bugs.webkit.org/show_bug.cgi?id=132482
     5
     6        Reviewed by Darin Adler.
     7
     8        Wrote named-map-removed-while-inserting-parent-crash.html by reducing the test case attached to bug 132482.
     9        The remaining tests were taken from blink r132482.
     10
     11        * fast/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
     12        * fast/dom/element-removed-while-inserting-parent-crash.html: Added.
     13        * fast/dom/named-map-removed-while-inserting-parent-crash-expected.txt: Added.
     14        * fast/dom/named-map-removed-while-inserting-parent-crash.html: Added.
     15        * fast/forms/form-control-removed-while-inserting-parent-crash-expected.txt: Added.
     16        * fast/forms/form-control-removed-while-inserting-parent-crash.html: Added.
     17        * svg/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
     18        * svg/dom/element-removed-while-inserting-parent-crash.html: Added.
     19
    1202015-06-19  Csaba Osztrogonác  <ossy@webkit.org>
    221

  • trunk/Source/WebCore/ChangeLog

    r185766 r185769  
     12015-06-19  Andy Estes  <aestes@apple.com>
     2
     3        Various assertion failures occur when executing script in the midst of DOM insertion
     4        https://bugs.webkit.org/show_bug.cgi?id=132482
     5
     6        Reviewed by Darin Adler.
     7
     8        Prior to this change, when an element containing a <script> child was inserted into a document, the script was
     9        executed in ScriptElement::insertedInto(). That script can access nodes that follow it in the newly-inserted
     10        hierarchy but are not yet fully inserted, leading to at least the following problems:
     11
     12            - The script could remove a node that is not yet marked as in the document.
     13            - The script could remove a named <map> that has yet to be added to TreeScope::m_imageMapsByName.
     14            - The script could remove a form control that has yet to be added to FormController::m_formElementsWithState.
     15
     16        These scenarios all result in assertion failures. This change ensures that each node in the newly-inserted
     17        hierarchy is fully inserted before executing any scripts.
     18
     19        Tests: fast/dom/element-removed-while-inserting-parent-crash.html
     20               fast/dom/named-map-removed-while-inserting-parent-crash.html
     21               fast/forms/form-control-removed-while-inserting-parent-crash.html
     22               svg/dom/element-removed-while-inserting-parent-crash.html
     23
     24        * dom/ScriptElement.cpp:
     25        (WebCore::ScriptElement::shouldNotifySubtreeInsertions): Renamed from insertedInto().
     26        Returned true in the case where insertedInto() would've called prepareScript().
     27        (WebCore::ScriptElement::didNotifySubtreeInsertions): Called prepareScript().
     28        (WebCore::ScriptElement::insertedInto): Renamed to shouldNotifySubtreeInsertions().
     29        * dom/ScriptElement.h:
     30        * html/HTMLScriptElement.cpp:
     31        (WebCore::HTMLScriptElement::insertedInto): If shouldNotifySubtreeInsertions() is true, returned InsertionShouldCallDidNotifySubtreeInsertions.
     32        Otherwise, returned InsertionDone.
     33        (WebCore::HTMLScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().
     34        * html/HTMLScriptElement.h:
     35        * svg/SVGScriptElement.cpp:
     36        (WebCore::SVGScriptElement::insertedInto): Did the same as HTMLScriptElement::insertedInto().
     37        (WebCore::SVGScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().
     38        * svg/SVGScriptElement.h:
     39
    1402015-06-19  Brent Fulgham  <bfulgham@apple.com>
    241

  • trunk/Source/WebCore/dom/ScriptElement.cpp

    r184434 r185769  
    8080}
    8181
    82 void ScriptElement::insertedInto(ContainerNode& insertionPoint)
    83 {
    84     if (insertionPoint.inDocument() && !m_parserInserted)
    85         prepareScript(); // FIXME: Provide a real starting line number here.
     82bool ScriptElement::shouldNotifySubtreeInsertions(ContainerNode& insertionPoint)
     83{
     84    return insertionPoint.inDocument() && !m_parserInserted;
     85}
     86
     87void ScriptElement::didNotifySubtreeInsertions()
     88{
     89    ASSERT(!m_parserInserted);
     90    prepareScript(); // FIXME: Provide a real starting line number here.
    8691}
    8792

  • trunk/Source/WebCore/dom/ScriptElement.h

    r170809 r185769  
    7070
    7171    // Helper functions used by our parent classes.
    72     void insertedInto(ContainerNode&);
     72    bool shouldNotifySubtreeInsertions(ContainerNode&);
     73    void didNotifySubtreeInsertions();
    7374    void childrenChanged();
    7475    void handleSourceAttribute(const String& sourceUrl);

  • trunk/Source/WebCore/html/HTMLScriptElement.cpp

    r182120 r185769  
    7171{
    7272    HTMLElement::insertedInto(insertionPoint);
    73     ScriptElement::insertedInto(insertionPoint);
    74     return InsertionDone;
     73    return shouldNotifySubtreeInsertions(insertionPoint) ? InsertionShouldCallDidNotifySubtreeInsertions : InsertionDone;
     74}
     75
     76void HTMLScriptElement::didNotifySubtreeInsertions()
     77{
     78    ScriptElement::didNotifySubtreeInsertions();
    7579}
    7680

  • trunk/Source/WebCore/html/HTMLScriptElement.h

    r177996 r185769  
    4747    virtual void parseAttribute(const QualifiedName&, const AtomicString&) override;
    4848    virtual InsertionNotificationRequest insertedInto(ContainerNode&) override;
     49    virtual void didNotifySubtreeInsertions() override;
    4950    virtual void childrenChanged(const ChildChange&) override;
    5051

  • trunk/Source/WebCore/svg/SVGScriptElement.cpp

    r182121 r185769  
    7878{
    7979    SVGElement::insertedInto(rootParent);
    80     ScriptElement::insertedInto(rootParent);
    8180    if (rootParent.inDocument())
    8281        SVGExternalResourcesRequired::insertedIntoDocument(this);
    83     return InsertionDone;
     82    return shouldNotifySubtreeInsertions(rootParent) ? InsertionShouldCallDidNotifySubtreeInsertions : InsertionDone;
     83}
     84
     85void SVGScriptElement::didNotifySubtreeInsertions()
     86{
     87    ScriptElement::didNotifySubtreeInsertions();
    8488}
    8589

  • trunk/Source/WebCore/svg/SVGScriptElement.h

    r185503 r185769  
    4343    virtual void parseAttribute(const QualifiedName&, const AtomicString&) override;
    4444    virtual InsertionNotificationRequest insertedInto(ContainerNode&) override;
     45    virtual void didNotifySubtreeInsertions() override;
    4546    virtual void childrenChanged(const ChildChange&) override;
    4647
Note: See TracChangeset for help on using the changeset viewer.