⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 220048 in webkit


Ignore:
Timestamp:
Jul 30, 2017, 12:38:31 AM (9 years ago)
Author:
commit-queue@webkit.org
Message:

RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
​https://bugs.webkit.org/show_bug.cgi?id=174874
<rdar://problem/33530130>

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2017-07-30
Reviewed by Darin Adler.

Source/WebCore:

If an <img> element has image content data for a none cached image, e.g.
-webkit-named-image, RenderImageResourceStyleImage will be created and
attached to the RenderImage. RenderImageResourceStyleImage::m_cachedImage
will be set to null because the m_styleImage->isCachedImage() is false in
this case. When ImageLoader finishes loading the url of the src attribute,
RenderImageResource::setCachedImage() will be called to set m_cachedImage.

A crash will happen when the RenderImage is destroyed. Destroying the
RenderImage calls RenderImageResourceStyleImage::shutdown() which checks
m_cachedImage and finds it not null, so it calls RenderImageResourceStyleImage::image()
which ends up calling CSSNamedImageValue::image() which returns a null pointer
because the size is empty. RenderImageResourceStyleImage::shutdown() calls
image()->stopAnimation() without checking the return value of image().

Like the base class virtual method RenderImageResource::image(),
RenderImageResourceStyleImage::image() should return the nullImage() if
the image is not available.

Test: fast/images/image-element-image-content-data.html

  • css/CSSCrossfadeValue.cpp:
  • css/CSSFilterImageValue.cpp:
  • page/EventHandler.cpp:
  • page/PageSerializer.cpp:
  • rendering/RenderElement.cpp:
  • rendering/RenderImageResource.cpp:
  • rendering/RenderImageResourceStyleImage.cpp:

(WebCore::RenderImageResourceStyleImage::initialize):

(WebCore::RenderImageResourceStyleImage::shutdown): Revert back the changes
of r208511 in this function. Add a call to image()->stopAnimation() without
checking the return of image() since it will return the nullImage() if
the image not available. There is no need to check m_cachedImage before
calling image() because image() does not check or access m_cachedImage.

(WebCore::RenderImageResourceStyleImage::image): The base class method
RenderImageResource::image() returns the nullImage() if the image not
available. This is because CachedImage::imageForRenderer() returns
the nullImage() if the image is not available; see CachedImage.h. We should
do the same for the derived class for consistency.

  • rendering/style/ContentData.cpp:
  • rendering/style/StyleCachedImage.cpp:
  • style/StylePendingResources.cpp:

LayoutTests:

  • fast/images/image-element-image-content-data-expected.txt: Added.
  • fast/images/image-element-image-content-data.html: Added.
Location:
trunk
Files:
2 added
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r220042 r220048  
     12017-07-30  Said Abou-Hallawa  <sabouhallawa@apple.com>
     2
     3        RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
     4        https://bugs.webkit.org/show_bug.cgi?id=174874
     5        <rdar://problem/33530130>
     6
     7        Reviewed by Darin Adler.
     8
     9        * fast/images/image-element-image-content-data-expected.txt: Added.
     10        * fast/images/image-element-image-content-data.html: Added.
     11
    1122017-07-29  Nan Wang  <n_wang@apple.com>
    213

  • trunk/Source/WebCore/ChangeLog

    r220045 r220048  
     12017-07-30  Said Abou-Hallawa  <sabouhallawa@apple.com>
     2
     3        RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
     4        https://bugs.webkit.org/show_bug.cgi?id=174874
     5        <rdar://problem/33530130>
     6
     7        Reviewed by Darin Adler.
     8
     9        If an <img> element has image content data for a none cached image, e.g.
     10        -webkit-named-image, RenderImageResourceStyleImage will be created and
     11        attached to the RenderImage. RenderImageResourceStyleImage::m_cachedImage
     12        will be set to null because the m_styleImage->isCachedImage() is false in
     13        this case. When ImageLoader finishes loading the url of the src attribute,
     14        RenderImageResource::setCachedImage() will be called to set m_cachedImage.
     15
     16        A crash will happen when the RenderImage is destroyed. Destroying the
     17        RenderImage calls RenderImageResourceStyleImage::shutdown() which checks
     18        m_cachedImage and finds it not null, so it calls RenderImageResourceStyleImage::image()
     19        which ends up calling CSSNamedImageValue::image() which returns a null pointer
     20        because the size is empty. RenderImageResourceStyleImage::shutdown() calls
     21        image()->stopAnimation() without checking the return value of image().
     22
     23        Like the base class virtual method RenderImageResource::image(),
     24        RenderImageResourceStyleImage::image() should return the nullImage() if
     25        the image is not available.
     26
     27        Test: fast/images/image-element-image-content-data.html
     28
     29        * css/CSSCrossfadeValue.cpp:
     30        * css/CSSFilterImageValue.cpp:
     31        * page/EventHandler.cpp:
     32        * page/PageSerializer.cpp:
     33        * rendering/RenderElement.cpp:
     34        * rendering/RenderImageResource.cpp:
     35        * rendering/RenderImageResourceStyleImage.cpp:
     36        (WebCore::RenderImageResourceStyleImage::initialize):
     37
     38        (WebCore::RenderImageResourceStyleImage::shutdown): Revert back the changes
     39        of r208511 in this function. Add a call to image()->stopAnimation() without
     40        checking the return of image() since it will return the nullImage() if
     41        the image not available. There is no need to check m_cachedImage before
     42        calling image() because image() does not check or access m_cachedImage.
     43
     44        (WebCore::RenderImageResourceStyleImage::image): The base class method
     45        RenderImageResource::image() returns the nullImage() if the image not
     46        available. This is because CachedImage::imageForRenderer() returns
     47        the nullImage() if the image is not available; see CachedImage.h. We should
     48        do the same for the derived class for consistency.
     49
     50        * rendering/style/ContentData.cpp:
     51        * rendering/style/StyleCachedImage.cpp:
     52        * style/StylePendingResources.cpp:
     53
    1542017-07-29  Filip Pizlo  <fpizlo@apple.com>
    255

  • trunk/Source/WebCore/css/CSSCrossfadeValue.cpp

    r218890 r220048  
    3434#include "CrossfadeGeneratedImage.h"
    3535#include "RenderElement.h"
    36 #include "StyleCachedImage.h"
    3736#include <wtf/text/StringBuilder.h>
    3837

  • trunk/Source/WebCore/css/CSSFilterImageValue.cpp

    r218890 r220048  
    3434#include "ImageBuffer.h"
    3535#include "RenderElement.h"
    36 #include "StyleCachedImage.h"
    3736#include "StyleResolver.h"
    3837#include <wtf/text/StringBuilder.h>

  • trunk/Source/WebCore/page/EventHandler.cpp

    r219961 r220048  
    8787#include "ShadowRoot.h"
    8888#include "SpatialNavigation.h"
    89 #include "StyleCachedImage.h"
    9089#include "TextEvent.h"
    9190#include "TextIterator.h"

  • trunk/Source/WebCore/page/PageSerializer.cpp

    r216702 r220048  
    5353#include "Page.h"
    5454#include "RenderElement.h"
    55 #include "StyleCachedImage.h"
    5655#include "StyleImage.h"
    5756#include "StyleProperties.h"

  • trunk/Source/WebCore/rendering/RenderElement.cpp

    r217893 r220048  
    5151#include "RenderFlexibleBox.h"
    5252#include "RenderImage.h"
    53 #include "RenderImageResourceStyleImage.h"
    5453#include "RenderInline.h"
    5554#include "RenderIterator.h"

  • trunk/Source/WebCore/rendering/RenderImageResource.cpp

    r217012 r220048  
    3333#include "RenderElement.h"
    3434#include "RenderImage.h"
    35 #include "RenderImageResourceStyleImage.h"
    3635
    3736namespace WebCore {

  • trunk/Source/WebCore/rendering/RenderImageResourceStyleImage.cpp

    r219205 r220048  
    3131#include "CachedImage.h"
    3232#include "RenderElement.h"
    33 #include "StyleCachedImage.h"
    3433
    3534namespace WebCore {
    … …  
    4948
    5049    if (m_styleImage->isCachedImage())
    51         m_cachedImage = m_styleImage.get().cachedImage();
     50        m_cachedImage = m_styleImage->cachedImage();
    5251
    5352    m_styleImage->addClient(m_renderer);
    … …  
    5756{
    5857    ASSERT(m_renderer);
     58    image()->stopAnimation();
    5959    m_styleImage->removeClient(m_renderer);
    60     if (m_cachedImage) {
    61         image()->stopAnimation();
    62         m_cachedImage = nullptr;
    63     }
     60    m_cachedImage = nullptr;
    6461}
    6562
    … …  
    6764{
    6865    // Generated content may trigger calls to image() while we're still pending, don't assert but gracefully exit.
    69     return !m_styleImage->isPending() ? m_styleImage->image(m_renderer, size) : &Image::nullImage();
     66    if (m_styleImage->isPending())
     67        return &Image::nullImage();
     68    if (auto image = m_styleImage->image(m_renderer, size))
     69        return image;
     70    return &Image::nullImage();
    7071}
    7172

  • trunk/Source/WebCore/rendering/style/ContentData.cpp

    r210758 r220048  
    2626#include "RenderImage.h"
    2727#include "RenderImageResource.h"
    28 #include "RenderImageResourceStyleImage.h"
    2928#include "RenderQuote.h"
    3029#include "RenderStyle.h"

  • trunk/Source/WebCore/rendering/style/StyleCachedImage.cpp

    r215700 r220048  
    3030#include "CachedImage.h"
    3131#include "RenderElement.h"
    32 #include "RenderView.h"
    3332
    3433namespace WebCore {

  • trunk/Source/WebCore/style/StylePendingResources.cpp

    r210758 r220048  
    3535#include "RenderStyle.h"
    3636#include "SVGURIReference.h"
    37 #include "StyleCachedImage.h"
    3837#include "StyleGeneratedImage.h"
    3938#include "TransformFunctions.h"
Note: See TracChangeset for help on using the changeset viewer.