Changeset 111439 in webkit


Ignore:
Timestamp:
Mar 20, 2012 2:31:46 PM (12 years ago)
Author:
robert@webkit.org
Message:

Use-after-free of continuation in RenderBlock::paintContinuationOutlines()
​https://bugs.webkit.org/show_bug.cgi?id=81276

Reviewed by David Hyatt.

Source/WebCore:

Test: fast/css/relative-positioned-block-crash.html

​https://trac.webkit.org/changeset/108185/ allowed anonymous blocks to get their own layer (when they're
relatively positioned). This broke the dependency in addContinuationWithOutline() on the owner of the continuation
table and the renderer getting added to it always being in the same layer. When they're not in the same layer
there's no guarantee that the owner of the continuation table will get painted again and so avoid any stale pointers
in its continuation table should any of the renderers in there get destroyed.

Fix this for now by only adding renderers to the containing block's continuation table if we don't have our own layer.
This fix causes fast/inline/continuation-outlines-with-layers.html to regress as it uses blocks inside relatively positioned
inlines, so skip it on all platforms pending a medium-term fix.

  • rendering/RenderBlock.cpp:

(WebCore::RenderBlock::paintObject):

LayoutTests:

  • fast/css/relative-positioned-block-crash-expected.txt: Added.
  • fast/css/relative-positioned-block-crash.html: Added.
  • platform/chromium/test_expectations.txt: Skip fast/inline/continuation-outlines-with-layers.html for now.
  • platform/gtk/Skipped: ditto
  • platform/mac/Skipped: ditto
  • platform/qt/Skipped: ditto
  • platform/win/Skipped: ditto
Location:
trunk
Files:
2 added
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r111437 r111439  
     12012-03-20  Robert Hogan  <robert@webkit.org>
     2
     3        Use-after-free of continuation in RenderBlock::paintContinuationOutlines()
     4        https://bugs.webkit.org/show_bug.cgi?id=81276
     5
     6        Reviewed by David Hyatt.
     7
     8        * fast/css/relative-positioned-block-crash-expected.txt: Added.
     9        * fast/css/relative-positioned-block-crash.html: Added.
     10        * platform/chromium/test_expectations.txt: Skip fast/inline/continuation-outlines-with-layers.html for now.
     11        * platform/gtk/Skipped: ditto
     12        * platform/mac/Skipped: ditto
     13        * platform/qt/Skipped: ditto
     14        * platform/win/Skipped: ditto
     15
    1162012-03-20  Dan Bernstein  <mitz@apple.com>
    217

  • trunk/LayoutTests/platform/chromium/test_expectations.txt

    r111397 r111439  
    39503950
    39513951BUGWK81638 SNOWLEOPARD DEBUG : editing/selection/iframe.html = IMAGE PASS
     3952
     3953// Allowed to regress to fix a crash.
     3954BUGWK81276 WIN LINUX: fast/inline/continuation-outlines-with-layers.html = IMAGE

  • trunk/LayoutTests/platform/gtk/Skipped

    r111409 r111439  
    16021602# https://bugs.webkit.org/show_bug.cgi?id=43022
    16031603tables/mozilla_expected_failures/bugs/bug85016.html
     1604
     1605# https://bugs.webkit.org/show_bug.cgi?id=81276
     1606# Allowed to regress to fix a crash.
     1607fast/inline/continuation-outlines-with-layers.html

  • trunk/LayoutTests/platform/mac/Skipped

    r111341 r111439  
    604604fast/workers/storage/use-same-database-in-page-and-workers.html
    605605
     606# https://bugs.webkit.org/show_bug.cgi?id=81276
     607# Allowed to regress to fix a crash.
     608fast/inline/continuation-outlines-with-layers.html

  • trunk/LayoutTests/platform/qt/Skipped

    r111409 r111439  
    27652765editing/selection/move-by-word-visually-textarea.html
    27662766editing/selection/move-by-word-visually-wrong-left-right.html
     2767
     2768# https://bugs.webkit.org/show_bug.cgi?id=81276
     2769# Allowed to regress to fix a crash.
     2770fast/inline/continuation-outlines-with-layers.html

  • trunk/LayoutTests/platform/win/Skipped

    r111185 r111439  
    18571857# https://bugs.webkit.org/show_bug.cgi?id=43022
    18581858tables/mozilla_expected_failures/bugs/bug85016.html
     1859
     1860# https://bugs.webkit.org/show_bug.cgi?id=81276
     1861# Allowed to regress to fix a crash.
     1862fast/inline/continuation-outlines-with-layers.html

  • trunk/Source/WebCore/ChangeLog

    r111436 r111439  
     12012-03-20  Robert Hogan  <robert@webkit.org>
     2
     3        Use-after-free of continuation in RenderBlock::paintContinuationOutlines()
     4        https://bugs.webkit.org/show_bug.cgi?id=81276
     5
     6        Reviewed by David Hyatt.
     7
     8        Test: fast/css/relative-positioned-block-crash.html
     9
     10        https://trac.webkit.org/changeset/108185/ allowed anonymous blocks to get their own layer (when they're
     11        relatively positioned). This broke the dependency in addContinuationWithOutline() on the owner of the continuation
     12        table and the renderer getting added to it always being in the same layer. When they're not in the same layer
     13        there's no guarantee that the owner of the continuation table will get painted again and so avoid any stale pointers
     14        in its continuation table should any of the renderers in there get destroyed.
     15
     16        Fix this for now by only adding renderers to the containing block's continuation table if we don't have our own layer.
     17        This fix causes fast/inline/continuation-outlines-with-layers.html to regress as it uses blocks inside relatively positioned
     18        inlines, so skip it on all platforms pending a medium-term fix.
     19
     20        * rendering/RenderBlock.cpp:
     21        (WebCore::RenderBlock::paintObject):
     22
    1232012-03-20  Adele Peterson  <adele@apple.com>
    224

  • trunk/Source/WebCore/rendering/RenderBlock.cpp

    r111279 r111439  
    29262926    if ((paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseChildOutlines)) {
    29272927        RenderInline* inlineCont = inlineElementContinuation();
    2928         if (inlineCont && inlineCont->hasOutline() && inlineCont->style()->visibility() == VISIBLE) {
     2928        // FIXME: For now, do not add continuations for outline painting by our containing block if we are a relative positioned
     2929        // anonymous block (i.e. have our own layer). This is because a block depends on renderers in its continuation table being
     2930        // in the same layer.
     2931        if (inlineCont && inlineCont->hasOutline() && inlineCont->style()->visibility() == VISIBLE && !hasLayer()) {
    29292932            RenderInline* inlineRenderer = toRenderInline(inlineCont->node()->renderer());
    29302933            RenderBlock* cb = containingBlock();
Note: See TracChangeset for help on using the changeset viewer.