Changeset 95619 in webkit

Timestamp:

Sep 21, 2011 6:08:19 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

Protect against misuse of EventListenerIterator.
​https://bugs.webkit.org/show_bug.cgi?id=68364

Patch by Andreas Kling <​kling@webkit.org> on 2011-09-21
Reviewed by Darin Adler.

In debug mode, keep track of the number of active EventListenerIterators
on an EventListenerMap, and assert that there are no iterators when the
map is being modified.

• dom/EventListenerMap.cpp:

(WebCore::EventListenerMap::EventListenerMap):
(WebCore::EventListenerMap::clear):
(WebCore::EventListenerMap::add):
(WebCore::EventListenerMap::remove):
(WebCore::EventListenerMap::find):
(WebCore::EventListenerMap::removeFirstEventListenerCreatedFromMarkup):
(WebCore::EventListenerMap::copyEventListenersNotCreatedFromMarkupToTarget):
(WebCore::EventListenerIterator::EventListenerIterator):
(WebCore::EventListenerIterator::~EventListenerIterator):

• dom/EventListenerMap.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/EventListenerMap.cpp (modified) (9 diffs)
• dom/EventListenerMap.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-09-21  Andreas Kling  <kling@webkit.org>
+
+        Protect against misuse of EventListenerIterator.
+        https://bugs.webkit.org/show_bug.cgi?id=68364
+
+        Reviewed by Darin Adler.
+
+        In debug mode, keep track of the number of active EventListenerIterators
+        on an EventListenerMap, and assert that there are no iterators when the
+        map is being modified.
+
+        * dom/EventListenerMap.cpp:
+        (WebCore::EventListenerMap::EventListenerMap):
+        (WebCore::EventListenerMap::clear):
+        (WebCore::EventListenerMap::add):
+        (WebCore::EventListenerMap::remove):
+        (WebCore::EventListenerMap::find):
+        (WebCore::EventListenerMap::removeFirstEventListenerCreatedFromMarkup):
+        (WebCore::EventListenerMap::copyEventListenersNotCreatedFromMarkupToTarget):
+        (WebCore::EventListenerIterator::EventListenerIterator):
+        (WebCore::EventListenerIterator::~EventListenerIterator):
+        * dom/EventListenerMap.h:
+
 2011-09-21  Pavel Feldman  <pfeldman@google.com>
 

trunk/Source/WebCore/dom/EventListenerMap.cpp

@@ -45 +45 @@
 
 EventListenerMap::EventListenerMap()
+#ifndef NDEBUG
+    : m_activeIteratorCount(0)
+#endif
 {
 }
@@ -69 +72 @@
 void EventListenerMap::clear()
 {
+    ASSERT(!m_activeIteratorCount);
+
     if (m_hashMap) {
         deleteAllValues(*m_hashMap);
@@ -106 +111 @@
 bool EventListenerMap::add(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
+    ASSERT(!m_activeIteratorCount);
+
     if (m_singleEventListenerVector && m_singleEventListenerType != eventType) {
         // We already have a single (first) listener vector, and this event is not
@@ -144 +151 @@
 bool EventListenerMap::remove(const AtomicString& eventType, EventListener* listener, bool useCapture, size_t& indexOfRemovedListener)
 {
+    ASSERT(!m_activeIteratorCount);
+
     if (!m_hashMap) {
         if (m_singleEventListenerType != eventType)
@@ -169 +178 @@
 EventListenerVector* EventListenerMap::find(const AtomicString& eventType)
 {
+    ASSERT(!m_activeIteratorCount);
+
     if (m_hashMap) {
         EventListenerHashMap::iterator it = m_hashMap->find(eventType);
@@ -201 +212 @@
 void EventListenerMap::removeFirstEventListenerCreatedFromMarkup(const AtomicString& eventType)
 {
+    ASSERT(!m_activeIteratorCount);
+
     if (m_hashMap) {
         EventListenerHashMap::iterator result = m_hashMap->find(eventType);
@@ -240 +253 @@
 void EventListenerMap::copyEventListenersNotCreatedFromMarkupToTarget(EventTarget* target)
 {
+    ASSERT(!m_activeIteratorCount);
+
     if (m_hashMap) {
         EventListenerHashMap::iterator end = m_hashMap->end();
@@ -273 +288 @@
     m_map = &data->eventListenerMap;
 
+#ifndef NDEBUG
+    m_map->m_activeIteratorCount++;
+#endif
+
     if (m_map->m_hashMap) {
         m_mapIterator = m_map->m_hashMap->begin();
@@ -278 +297 @@
     }
 }
+
+#ifndef NDEBUG
+EventListenerIterator::~EventListenerIterator()
+{
+    if (m_map)
+        m_map->m_activeIteratorCount--;
+}
+#endif
 
 EventListener* EventListenerIterator::nextListener()

trunk/Source/WebCore/dom/EventListenerMap.h

@@ -76 +76 @@
     AtomicString m_singleEventListenerType;
     OwnPtr<EventListenerVector> m_singleEventListenerVector;
+
+#ifndef NDEBUG
+    int m_activeIteratorCount;
+#endif
 };
 
@@ -82 +86 @@
 public:
     EventListenerIterator();
-
-    // EventTarget must not be modified while an iterator is active.
     EventListenerIterator(EventTarget*);
+#ifndef NDEBUG
+    ~EventListenerIterator();
+#endif
 
     EventListener* nextListener();