Changeset 26941 in webkit

Timestamp:

Oct 23, 2007, 6:51:04 PM (17 years ago)

Author:

mitz

Message:

Reviewed by Eric Seidel.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=15405 ASSERTION FAILED: d->m_view && !d->m_view->needsLayout() in Frame::Paint

Calling updateWidget() during attach() led to arbitrary (plugin and resource load delegate)
code execution under attach(). The fix is to use the mechanism that's already in place for
deferring updateWidget() until after layout.

• html/HTMLEmbedElement.cpp: (WebCore::HTMLEmbedElement::attach): Replaced call to updateWidget() with call to updateWidgetSoon()
• html/HTMLObjectElement.cpp: (WebCore::HTMLObjectElement::attach): Ditto.
• manual-tests/paint-during-plugin-attach.html: Added.
• rendering/RenderPartObject.cpp: (WebCore::RenderPartObject::updateWidgetSoon): Added this function that schedules the updateWidget() call for after the next layout.
• rendering/RenderPartObject.h:

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLEmbedElement.cpp (modified) (1 diff)
• html/HTMLObjectElement.cpp (modified) (1 diff)
• manual-tests/paint-during-plugin-attach.html (added)
• rendering/RenderPartObject.cpp (modified) (1 diff)
• rendering/RenderPartObject.h (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2007-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15405
+          ASSERTION FAILED: d->m_view && !d->m_view->needsLayout() in Frame::Paint
+
+        Calling updateWidget() during attach() led to arbitrary (plugin and resource load delegate)
+        code execution under attach(). The fix is to use the mechanism that's already in place for
+        deferring updateWidget() until after layout.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::attach): Replaced call to updateWidget() with call to updateWidgetSoon()
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::attach): Ditto.
+        * manual-tests/paint-during-plugin-attach.html: Added.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidgetSoon): Added this function that schedules the
+        updateWidget() call for after the next layout.
+        * rendering/RenderPartObject.h:
+
 2007-10-23  Adam Roben  <aroben@apple.com>
 

trunk/WebCore/html/HTMLEmbedElement.cpp

@@ -157 +157 @@
 
     if (renderer())
-        static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+        static_cast<RenderPartObject*>(renderer())->updateWidgetSoon();
 }
 

trunk/WebCore/html/HTMLObjectElement.cpp

@@ -187 +187 @@
                 // this method or recalcStyle (which also calls updateWidget) to be called.
                 m_needWidgetUpdate = false;
-                static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+                static_cast<RenderPartObject*>(renderer())->updateWidgetSoon();
             } else {
                 m_needWidgetUpdate = true;

trunk/WebCore/rendering/RenderPartObject.cpp

@@ -281 +281 @@
 }
 
+void RenderPartObject::updateWidgetSoon()
+{
+    if (m_view)
+        m_view->addWidgetToUpdate(this);
+}
+
 void RenderPartObject::viewCleared()
 {

trunk/WebCore/rendering/RenderPartObject.h

@@ -39 +39 @@
     virtual void layout();
     void updateWidget(bool onlyCreateNonPlugins);
+    void updateWidgetSoon();
 
     virtual void viewCleared();