Changeset 141783 in webkit


Ignore:
Timestamp:
Feb 4, 2013 10:43:03 AM (11 years ago)
Author:
inferno@chromium.org
Message:

Add ASSERT_WITH_SECURITY_IMPLICATION to detect bad cast in DOM, CSS, etc.
​https://bugs.webkit.org/show_bug.cgi?id=108688

Reviewed by Eric Seidel.

Source/WebCore:

  • Modules/notifications/Notification.cpp:

(WebCore::Notification::Notification):
(WebCore::Notification::permission):
(WebCore::Notification::requestPermission):

  • Modules/speech/SpeechGrammar.cpp:

(WebCore::SpeechGrammar::setSrc):

  • Modules/speech/SpeechGrammarList.cpp:

(WebCore::SpeechGrammarList::addFromUri):

  • Modules/websockets/ThreadableWebSocketChannel.cpp:

(WebCore::ThreadableWebSocketChannel::create):

  • accessibility/AccessibilityMenuListPopup.cpp:

(WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):

  • accessibility/AccessibilityTable.cpp:

(WebCore::AccessibilityTable::cellForColumnAndRow):

  • css/CSSFontFaceRule.cpp:

(WebCore::CSSFontFaceRule::reattach):

  • css/CSSImageSetValue.cpp:

(WebCore::CSSImageSetValue::fillImageSet):

  • css/CSSPageRule.cpp:

(WebCore::CSSPageRule::reattach):

  • css/CSSStyleRule.cpp:

(WebCore::CSSStyleRule::reattach):

  • css/StyleBuilder.cpp:

(WebCore::ApplyPropertyFontVariantLigatures::applyValue):
(WebCore::ApplyPropertyTextDecoration::applyValue):
(WebCore::ApplyPropertyZoom::applyValue):

  • css/StyleResolver.cpp:

(WebCore::createGridPosition):
(WebCore::StyleResolver::applyProperty):
(WebCore::StyleResolver::createCustomFilterOperationWithInlineSyntax):

  • css/WebKitCSSFilterRule.cpp:

(WebCore::WebKitCSSFilterRule::reattach):

  • css/WebKitCSSKeyframesRule.cpp:

(WebCore::WebKitCSSKeyframesRule::reattach):

  • css/WebKitCSSViewportRule.cpp:

(WebCore::WebKitCSSViewportRule::reattach):

  • editing/EditCommand.h:

(WebCore::toSimpleEditCommand):

  • editing/visible_units.cpp:

(WebCore::startOfParagraph):
(WebCore::endOfParagraph):

  • html/HTMLCollection.cpp:

(WebCore::LiveNodeListBase::setItemCache):

  • loader/ThreadableLoader.cpp:

(WebCore::ThreadableLoader::create):
(WebCore::ThreadableLoader::loadResourceSynchronously):

  • loader/WorkerThreadableLoader.cpp:

(WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):

  • page/Frame.cpp:

(WebCore::Frame::frameForWidget):

  • platform/RefCountedSupplement.h:

(WebCore::RefCountedSupplement::from):

  • rendering/RenderBlock.cpp:

(WebCore::RenderBlock::splitBlocks):
(WebCore::RenderBlock::firstLineBlock):

  • rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlock::createLineBoxes):

  • rendering/RenderBox.cpp:

(WebCore::RenderBox::computeReplacedLogicalHeightUsing):

  • rendering/svg/RenderSVGText.cpp:

(WebCore::RenderSVGText::positionForPoint):

  • rendering/svg/SVGRootInlineBox.cpp:

(WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
(WebCore::SVGRootInlineBox::layoutChildBoxes):

  • testing/js/WebCoreTestSupport.cpp:

(WebCoreTestSupport::resetInternalsObject):

  • testing/v8/WebCoreTestSupport.cpp:

(WebCoreTestSupport::resetInternalsObject):

  • workers/DefaultSharedWorkerRepository.cpp:

(WebCore::SharedWorkerProxy::addToWorkerDocuments):
(WebCore::SharedWorkerConnectTask::performTask):

  • workers/SharedWorker.cpp:

(WebCore::SharedWorker::create):

  • workers/WorkerContext.cpp:

(WebCore::CloseWorkerContextTask::performTask):

  • workers/WorkerMessagingProxy.cpp:

(WebCore::MessageWorkerContextTask::performTask):
(WebCore::connectToWorkerContextInspectorTask):
(WebCore::disconnectFromWorkerContextInspectorTask):
(WebCore::dispatchOnInspectorBackendTask):

  • workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously):

  • workers/WorkerThread.cpp:

(WebCore::WorkerThreadShutdownFinishTask::performTask):
(WebCore::WorkerThreadShutdownStartTask::performTask):

Source/WebKit/blackberry:

  • Api/WebPage.cpp:

(BlackBerry::WebKit::WebPagePrivate::handleMouseEvent):

  • WebKitSupport/FatFingers.cpp:

(BlackBerry::WebKit::FatFingers::setSuccessfulFatFingersResult):

Source/WebKit/chromium:

  • src/IDBFactoryBackendProxy.cpp:

(WebKit::IDBFactoryBackendProxy::allowIndexedDB):
(WebKit::getWebFrame):

  • src/LocalFileSystemChromium.cpp:

(WebCore::LocalFileSystem::deleteFileSystem):

  • src/WebSharedWorkerImpl.cpp:

(WebKit::WebSharedWorkerImpl::connectTask):
(WebKit::resumeWorkerContextTask):
(WebKit::connectToWorkerContextInspectorTask):
(WebKit::reconnectToWorkerContextInspectorTask):
(WebKit::disconnectFromWorkerContextInspectorTask):
(WebKit::dispatchOnInspectorBackendTask):

Source/WebKit/qt:

  • WebCoreSupport/FrameLoaderClientQt.cpp:
Location:
trunk/Source
Files:
45 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r141778 r141783  
     12013-02-04  Abhishek Arya  <inferno@chromium.org>
     2
     3        Add ASSERT_WITH_SECURITY_IMPLICATION to detect bad cast in DOM, CSS, etc.
     4        https://bugs.webkit.org/show_bug.cgi?id=108688
     5
     6        Reviewed by Eric Seidel.
     7
     8        * Modules/notifications/Notification.cpp:
     9        (WebCore::Notification::Notification):
     10        (WebCore::Notification::permission):
     11        (WebCore::Notification::requestPermission):
     12        * Modules/speech/SpeechGrammar.cpp:
     13        (WebCore::SpeechGrammar::setSrc):
     14        * Modules/speech/SpeechGrammarList.cpp:
     15        (WebCore::SpeechGrammarList::addFromUri):
     16        * Modules/websockets/ThreadableWebSocketChannel.cpp:
     17        (WebCore::ThreadableWebSocketChannel::create):
     18        * accessibility/AccessibilityMenuListPopup.cpp:
     19        (WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
     20        * accessibility/AccessibilityTable.cpp:
     21        (WebCore::AccessibilityTable::cellForColumnAndRow):
     22        * css/CSSFontFaceRule.cpp:
     23        (WebCore::CSSFontFaceRule::reattach):
     24        * css/CSSImageSetValue.cpp:
     25        (WebCore::CSSImageSetValue::fillImageSet):
     26        * css/CSSPageRule.cpp:
     27        (WebCore::CSSPageRule::reattach):
     28        * css/CSSStyleRule.cpp:
     29        (WebCore::CSSStyleRule::reattach):
     30        * css/StyleBuilder.cpp:
     31        (WebCore::ApplyPropertyFontVariantLigatures::applyValue):
     32        (WebCore::ApplyPropertyTextDecoration::applyValue):
     33        (WebCore::ApplyPropertyZoom::applyValue):
     34        * css/StyleResolver.cpp:
     35        (WebCore::createGridPosition):
     36        (WebCore::StyleResolver::applyProperty):
     37        (WebCore::StyleResolver::createCustomFilterOperationWithInlineSyntax):
     38        * css/WebKitCSSFilterRule.cpp:
     39        (WebCore::WebKitCSSFilterRule::reattach):
     40        * css/WebKitCSSKeyframesRule.cpp:
     41        (WebCore::WebKitCSSKeyframesRule::reattach):
     42        * css/WebKitCSSViewportRule.cpp:
     43        (WebCore::WebKitCSSViewportRule::reattach):
     44        * editing/EditCommand.h:
     45        (WebCore::toSimpleEditCommand):
     46        * editing/visible_units.cpp:
     47        (WebCore::startOfParagraph):
     48        (WebCore::endOfParagraph):
     49        * html/HTMLCollection.cpp:
     50        (WebCore::LiveNodeListBase::setItemCache):
     51        * loader/ThreadableLoader.cpp:
     52        (WebCore::ThreadableLoader::create):
     53        (WebCore::ThreadableLoader::loadResourceSynchronously):
     54        * loader/WorkerThreadableLoader.cpp:
     55        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
     56        * page/Frame.cpp:
     57        (WebCore::Frame::frameForWidget):
     58        * platform/RefCountedSupplement.h:
     59        (WebCore::RefCountedSupplement::from):
     60        * rendering/RenderBlock.cpp:
     61        (WebCore::RenderBlock::splitBlocks):
     62        (WebCore::RenderBlock::firstLineBlock):
     63        * rendering/RenderBlockLineLayout.cpp:
     64        (WebCore::RenderBlock::createLineBoxes):
     65        * rendering/RenderBox.cpp:
     66        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
     67        * rendering/svg/RenderSVGText.cpp:
     68        (WebCore::RenderSVGText::positionForPoint):
     69        * rendering/svg/SVGRootInlineBox.cpp:
     70        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
     71        (WebCore::SVGRootInlineBox::layoutChildBoxes):
     72        * testing/js/WebCoreTestSupport.cpp:
     73        (WebCoreTestSupport::resetInternalsObject):
     74        * testing/v8/WebCoreTestSupport.cpp:
     75        (WebCoreTestSupport::resetInternalsObject):
     76        * workers/DefaultSharedWorkerRepository.cpp:
     77        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
     78        (WebCore::SharedWorkerConnectTask::performTask):
     79        * workers/SharedWorker.cpp:
     80        (WebCore::SharedWorker::create):
     81        * workers/WorkerContext.cpp:
     82        (WebCore::CloseWorkerContextTask::performTask):
     83        * workers/WorkerMessagingProxy.cpp:
     84        (WebCore::MessageWorkerContextTask::performTask):
     85        (WebCore::connectToWorkerContextInspectorTask):
     86        (WebCore::disconnectFromWorkerContextInspectorTask):
     87        (WebCore::dispatchOnInspectorBackendTask):
     88        * workers/WorkerScriptLoader.cpp:
     89        (WebCore::WorkerScriptLoader::loadSynchronously):
     90        * workers/WorkerThread.cpp:
     91        (WebCore::WorkerThreadShutdownFinishTask::performTask):
     92        (WebCore::WorkerThreadShutdownStartTask::performTask):
     93
    1942013-02-04  Dominik Röttsches  <dominik.rottsches@intel.com>
    295

  • trunk/Source/WebCore/Modules/notifications/Notification.cpp

    r141202 r141783  
    110110    , m_taskTimer(adoptPtr(new Timer<Notification>(this, &Notification::taskTimerFired)))
    111111{
    112     ASSERT(context->isDocument());
     112    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    113113    m_notificationCenter = DOMWindowNotifications::webkitNotifications(static_cast<Document*>(context)->domWindow());
    114114   
    … …  
    260260const String& Notification::permission(ScriptExecutionContext* context)
    261261{
    262     ASSERT(context->isDocument());
     262    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    263263    ASSERT(static_cast<Document*>(context)->page());
    264264    return permissionString(NotificationController::from(static_cast<Document*>(context)->page())->client()->checkPermission(context));
    … …  
    286286void Notification::requestPermission(ScriptExecutionContext* context, PassRefPtr<NotificationPermissionCallback> callback)
    287287{
    288     ASSERT(context->isDocument());
     288    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    289289    ASSERT(static_cast<Document*>(context)->page());
    290290    NotificationController::from(static_cast<Document*>(context)->page())->client()->requestPermission(context, callback);

  • trunk/Source/WebCore/Modules/speech/SpeechGrammar.cpp

    r110281 r141783  
    4646void SpeechGrammar::setSrc(ScriptExecutionContext* scriptExecutionContext, const String& src)
    4747{
    48     ASSERT(scriptExecutionContext->isDocument());
     48    ASSERT_WITH_SECURITY_IMPLICATION(scriptExecutionContext->isDocument());
    4949    Document* document = static_cast<Document*>(scriptExecutionContext);
    5050    m_src = document->completeURL(src);

  • trunk/Source/WebCore/Modules/speech/SpeechGrammarList.cpp

    r110281 r141783  
    4949void SpeechGrammarList::addFromUri(ScriptExecutionContext* scriptExecutionContext, const String& src, double weight)
    5050{
    51     ASSERT(scriptExecutionContext->isDocument());
     51    ASSERT_WITH_SECURITY_IMPLICATION(scriptExecutionContext->isDocument());
    5252    Document* document = static_cast<Document*>(scriptExecutionContext);
    5353    m_grammars.append(SpeechGrammar::create(document->completeURL(src), weight));

  • trunk/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp

    r127757 r141783  
    6666#endif // ENABLE(WORKERS)
    6767
    68     ASSERT(context->isDocument());
     68    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    6969    return WebSocketChannel::create(static_cast<Document*>(context), client);
    7070}

  • trunk/Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp

    r116376 r141783  
    7474
    7575    AccessibilityObject* object = document()->axObjectCache()->getOrCreate(MenuListOptionRole);
    76     ASSERT(object->isMenuListOption());
     76    ASSERT_WITH_SECURITY_IMPLICATION(object->isMenuListOption());
    7777
    7878    AccessibilityMenuListOption* option = static_cast<AccessibilityMenuListOption*>(object);

  • trunk/Source/WebCore/accessibility/AccessibilityTable.cpp

    r140658 r141783  
    580580   
    581581    AccessibilityObject* cellObject = axObjectCache()->getOrCreate(cell);
    582     ASSERT(cellObject->isTableCell());
     582    ASSERT_WITH_SECURITY_IMPLICATION(cellObject->isTableCell());
    583583   
    584584    return static_cast<AccessibilityTableCell*>(cellObject);

  • trunk/Source/WebCore/css/CSSFontFaceRule.cpp

    r141570 r141783  
    6565{
    6666    ASSERT(rule);
    67     ASSERT(rule->isFontFaceRule());
     67    ASSERT_WITH_SECURITY_IMPLICATION(rule->isFontFaceRule());
    6868    m_fontFaceRule = static_cast<StyleRuleFontFace*>(rule);
    6969    if (m_propertiesCSSOMWrapper)

  • trunk/Source/WebCore/css/CSSImageSetValue.cpp

    r141570 r141783  
    6363    while (i < length) {
    6464        CSSValue* imageValue = item(i);
    65         ASSERT(imageValue->isImageValue());
     65        ASSERT_WITH_SECURITY_IMPLICATION(imageValue->isImageValue());
    6666        String imageURL = static_cast<CSSImageValue*>(imageValue)->url();
    6767
    … …  
    6969        ASSERT(i < length);
    7070        CSSValue* scaleFactorValue = item(i);
    71         ASSERT(scaleFactorValue->isPrimitiveValue());
     71        ASSERT_WITH_SECURITY_IMPLICATION(scaleFactorValue->isPrimitiveValue());
    7272        float scaleFactor = static_cast<CSSPrimitiveValue*>(scaleFactorValue)->getFloatValue();
    7373

  • trunk/Source/WebCore/css/CSSPageRule.cpp

    r141570 r141783  
    9898{
    9999    ASSERT(rule);
    100     ASSERT(rule->isPageRule());
     100    ASSERT_WITH_SECURITY_IMPLICATION(rule->isPageRule());
    101101    m_pageRule = static_cast<StyleRulePage*>(rule);
    102102    if (m_propertiesCSSOMWrapper)

  • trunk/Source/WebCore/css/CSSStyleRule.cpp

    r141570 r141783  
    126126{
    127127    ASSERT(rule);
    128     ASSERT(rule->isStyleRule());
     128    ASSERT_WITH_SECURITY_IMPLICATION(rule->isStyleRule());
    129129    m_styleRule = static_cast<StyleRule*>(rule);
    130130    if (m_propertiesCSSOMWrapper)

  • trunk/Source/WebCore/css/StyleBuilder.cpp

    r139798 r141783  
    874874#if !ASSERT_DISABLED
    875875        else {
    876             ASSERT(value->isPrimitiveValue());
     876            ASSERT_WITH_SECURITY_IMPLICATION(value->isPrimitiveValue());
    877877            ASSERT(static_cast<CSSPrimitiveValue*>(value)->getIdent() == CSSValueNormal);
    878878        }
    … …  
    11381138        for (CSSValueListIterator i(value); i.hasMore(); i.advance()) {
    11391139            CSSValue* item = i.value();
    1140             ASSERT(item->isPrimitiveValue());
     1140            ASSERT_WITH_SECURITY_IMPLICATION(item->isPrimitiveValue());
    11411141            t |= *static_cast<CSSPrimitiveValue*>(item);
    11421142        }
    … …  
    16101610    static void applyValue(CSSPropertyID, StyleResolver* styleResolver, CSSValue* value)
    16111611    {
    1612         ASSERT(value->isPrimitiveValue());
     1612        ASSERT_WITH_SECURITY_IMPLICATION(value->isPrimitiveValue());
    16131613        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
    16141614

  • trunk/Source/WebCore/css/StyleResolver.cpp

    r141750 r141783  
    27142714        return true;
    27152715
    2716     ASSERT(primitiveValue->isNumber());
     2716    ASSERT_WITH_SECURITY_IMPLICATION(primitiveValue->isNumber());
    27172717    position.setIntegerPosition(primitiveValue->getIntValue());
    27182718    return true;
    … …  
    27972797#if ENABLE(CSS_VARIABLES)
    27982798    if (id == CSSPropertyVariable) {
    2799         ASSERT(value->isVariableValue());
     2799        ASSERT_WITH_SECURITY_IMPLICATION(value->isVariableValue());
    28002800        CSSVariableValue* variable = static_cast<CSSVariableValue*>(value);
    28012801        ASSERT(!variable->name().isEmpty());
    … …  
    29382938                if (!second)
    29392939                    continue;
    2940                 ASSERT(first->isPrimitiveValue());
    2941                 ASSERT(second->isPrimitiveValue());
     2940                ASSERT_WITH_SECURITY_IMPLICATION(first->isPrimitiveValue());
     2941                ASSERT_WITH_SECURITY_IMPLICATION(second->isPrimitiveValue());
    29422942                String startQuote = static_cast<CSSPrimitiveValue*>(first)->getStringValue();
    29432943                String endQuote = static_cast<CSSPrimitiveValue*>(second)->getStringValue();
    … …  
    47714771{
    47724772    CSSValue* shadersValue = filterValue->itemWithoutBoundsCheck(0);
    4773     ASSERT(shadersValue->isValueList());
     4773    ASSERT_WITH_SECURITY_IMPLICATION(shadersValue->isValueList());
    47744774    CSSValueList* shadersList = static_cast<CSSValueList*>(shadersValue);
    47754775

  • trunk/Source/WebCore/css/WebKitCSSFilterRule.cpp

    r140997 r141783  
    8181{
    8282    ASSERT(rule);
    83     ASSERT(rule->isFilterRule());
     83    ASSERT_WITH_SECURITY_IMPLICATION(rule->isFilterRule());
    8484    m_filterRule = static_cast<StyleRuleFilter*>(rule);
    8585    if (m_propertiesCSSOMWrapper)

  • trunk/Source/WebCore/css/WebKitCSSKeyframesRule.cpp

    r141570 r141783  
    204204{
    205205    ASSERT(rule);
    206     ASSERT(rule->isKeyframesRule());
     206    ASSERT_WITH_SECURITY_IMPLICATION(rule->isKeyframesRule());
    207207    m_keyframesRule = static_cast<StyleRuleKeyframes*>(rule);
    208208}

  • trunk/Source/WebCore/css/WebKitCSSViewportRule.cpp

    r141570 r141783  
    8080{
    8181    ASSERT(rule);
    82     ASSERT(rule->isViewportRule());
     82    ASSERT_WITH_SECURITY_IMPLICATION(rule->isViewportRule());
    8383    m_viewportRule = static_cast<StyleRuleViewport*>(rule);
    8484

  • trunk/Source/WebCore/editing/EditCommand.h

    r133820 r141783  
    102102{
    103103    ASSERT(command);
    104     ASSERT(command->isSimpleEditCommand());
     104    ASSERT_WITH_SECURITY_IMPLICATION(command->isSimpleEditCommand());
    105105    return static_cast<SimpleEditCommand*>(command);
    106106}

  • trunk/Source/WebCore/editing/visible_units.cpp

    r137336 r141783  
    11371137
    11381138        if (r->isText() && toRenderText(r)->renderedTextLength()) {
    1139             ASSERT(n->isTextNode());
     1139            ASSERT_WITH_SECURITY_IMPLICATION(n->isTextNode());
    11401140            type = Position::PositionIsOffsetInAnchor;
    11411141            if (style->preserveNewline()) {
    … …  
    12191219        // FIXME: We avoid returning a position where the renderer can't accept the caret.
    12201220        if (r->isText() && toRenderText(r)->renderedTextLength()) {
    1221             ASSERT(n->isTextNode());
     1221            ASSERT_WITH_SECURITY_IMPLICATION(n->isTextNode());
    12221222            int length = toRenderText(r)->textLength();
    12231223            type = Position::PositionIsOffsetInAnchor;

  • trunk/Source/WebCore/html/HTMLCollection.cpp

    r138195 r141783  
    419419    setItemCache(item, offset);
    420420    if (overridesItemAfter()) {
    421         ASSERT(item->isElementNode());
     421        ASSERT_WITH_SECURITY_IMPLICATION(item->isElementNode());
    422422        static_cast<const HTMLCollection*>(this)->m_cachedElementsArrayOffset = elementsArrayOffset;
    423423    } else

  • trunk/Source/WebCore/loader/ThreadableLoader.cpp

    r95901 r141783  
    5151#endif // ENABLE(WORKERS)
    5252
    53     ASSERT(context->isDocument());
     53    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    5454    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, options);
    5555}
    … …  
    6666#endif // ENABLE(WORKERS)
    6767
    68     ASSERT(context->isDocument());
     68    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    6969    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, options);
    7070}

  • trunk/Source/WebCore/loader/WorkerThreadableLoader.cpp

    r138083 r141783  
    108108{
    109109    ASSERT(isMainThread());
    110     ASSERT(context->isDocument());
     110    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    111111    Document* document = static_cast<Document*>(context);
    112112

  • trunk/Source/WebCore/page/Frame.cpp

    r141570 r141783  
    631631    // Assume all widgets are either a FrameView or owned by a RenderWidget.
    632632    // FIXME: That assumption is not right for scroll bars!
    633     ASSERT(widget->isFrameView());
     633    ASSERT_WITH_SECURITY_IMPLICATION(widget->isFrameView());
    634634    return static_cast<const FrameView*>(widget)->frame();
    635635}

  • trunk/Source/WebCore/platform/RefCountedSupplement.h

    r140509 r141783  
    6464        if (!found)
    6565            return 0;
    66         ASSERT(found->isRefCountedWrapper());
     66        ASSERT_WITH_SECURITY_IMPLICATION(found->isRefCountedWrapper());
    6767        return static_cast<Wrapper*>(found)->wrapped();
    6868    }

  • trunk/Source/WebCore/rendering/RenderBlock.cpp

    r141570 r141783  
    606606
    607607    while (curr && curr != fromBlock) {
    608         ASSERT(curr->isRenderBlock());
     608        ASSERT_WITH_SECURITY_IMPLICATION(curr->isRenderBlock());
    609609       
    610610        RenderBlock* blockCurr = toRenderBlock(curr);
    … …  
    63976397            !parentBlock || parentBlock->firstChild() != firstLineBlock || !parentBlock->isBlockFlow())
    63986398            break;
    6399         ASSERT(parentBlock->isRenderBlock());
     6399        ASSERT_WITH_SECURITY_IMPLICATION(parentBlock->isRenderBlock());
    64006400        firstLineBlock = toRenderBlock(parentBlock);
    64016401    }

  • trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

    r141606 r141783  
    456456    bool hasDefaultLineBoxContain = style()->lineBoxContain() == RenderStyle::initialLineBoxContain();
    457457    do {
    458         ASSERT(obj->isRenderInline() || obj == this);
     458        ASSERT_WITH_SECURITY_IMPLICATION(obj->isRenderInline() || obj == this);
    459459
    460460        RenderInline* inlineFlow = (obj != this) ? toRenderInline(obj) : 0;
    … …  
    476476            // made, we need to place it at the end of the current line.
    477477            InlineBox* newBox = createInlineBoxForRenderer(obj, obj == this);
    478             ASSERT(newBox->isInlineFlowBox());
     478            ASSERT_WITH_SECURITY_IMPLICATION(newBox->isInlineFlowBox());
    479479            parentBox = toInlineFlowBox(newBox);
    480480            parentBox->setFirstLineStyleBit(lineInfo.isFirstLine());

  • trunk/Source/WebCore/rendering/RenderBox.cpp

    r141570 r141783  
    26482648            // https://bugs.webkit.org/show_bug.cgi?id=46500
    26492649            if (cb->isOutOfFlowPositioned() && cb->style()->height().isAuto() && !(cb->style()->top().isAuto() || cb->style()->bottom().isAuto())) {
    2650                 ASSERT(cb->isRenderBlock());
     2650                ASSERT_WITH_SECURITY_IMPLICATION(cb->isRenderBlock());
    26512651                RenderBlock* block = toRenderBlock(cb);
    26522652                LogicalExtentComputedValues computedValues;

  • trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp

    r137847 r141783  
    473473        return createVisiblePosition(0, DOWNSTREAM);
    474474
    475     ASSERT(rootBox->isSVGRootInlineBox());
     475    ASSERT_WITH_SECURITY_IMPLICATION(rootBox->isSVGRootInlineBox());
    476476    ASSERT(!rootBox->nextRootBox());
    477477    ASSERT(childrenInline());

  • trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp

    r140728 r141783  
    110110                continue;
    111111
    112             ASSERT(child->isInlineFlowBox());
     112            ASSERT_WITH_SECURITY_IMPLICATION(child->isInlineFlowBox());
    113113
    114114            SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);
    … …  
    150150                continue;
    151151
    152             ASSERT(child->isInlineFlowBox());
     152            ASSERT_WITH_SECURITY_IMPLICATION(child->isInlineFlowBox());
    153153
    154154            SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);

  • trunk/Source/WebCore/testing/js/WebCoreTestSupport.cpp

    r138727 r141783  
    5656    JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
    5757    ScriptExecutionContext* scriptContext = globalObject->scriptExecutionContext();
    58     ASSERT(scriptContext->isDocument());
     58    ASSERT_WITH_SECURITY_IMPLICATION(scriptContext->isDocument());
    5959    Page* page = static_cast<Document*>(scriptContext)->frame()->page();
    6060    Internals::resetToConsistentState(page);

  • trunk/Source/WebCore/testing/v8/WebCoreTestSupport.cpp

    r140401 r141783  
    6060
    6161    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
    62     ASSERT(scriptContext->isDocument());
     62    ASSERT_WITH_SECURITY_IMPLICATION(scriptContext->isDocument());
    6363    Page* page = static_cast<Document*>(scriptContext)->frame()->page();
    6464    Internals::resetToConsistentState(page);

  • trunk/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp

    r137318 r141783  
    229229{
    230230    // Nested workers are not yet supported, so passed-in context should always be a Document.
    231     ASSERT(context->isDocument());
     231    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    232232    ASSERT(!isClosing());
    233233    MutexLocker lock(m_workerDocumentsLock);
    … …  
    273273        RefPtr<MessagePort> port = MessagePort::create(*scriptContext);
    274274        port->entangle(m_channel.release());
    275         ASSERT(scriptContext->isWorkerContext());
     275        ASSERT_WITH_SECURITY_IMPLICATION(scriptContext->isWorkerContext());
    276276        WorkerContext* workerContext = static_cast<WorkerContext*>(scriptContext);
    277277        // Since close() stops the thread event loop, this should not ever get called while closing.
    278278        ASSERT(!workerContext->isClosing());
    279         ASSERT(workerContext->isSharedWorkerContext());
     279        ASSERT_WITH_SECURITY_IMPLICATION(workerContext->isSharedWorkerContext());
    280280        workerContext->dispatchEvent(createConnectEvent(port));
    281281    }

  • trunk/Source/WebCore/workers/SharedWorker.cpp

    r141466 r141783  
    7171
    7272    // We don't currently support nested workers, so workers can only be created from documents.
    73     ASSERT(context->isDocument());
     73    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    7474    Document* document = static_cast<Document*>(context);
    7575    if (!document->securityOrigin()->canAccessSharedWorkers(document->topOrigin())) {

  • trunk/Source/WebCore/workers/WorkerContext.cpp

    r137318 r141783  
    7777    virtual void performTask(ScriptExecutionContext *context)
    7878    {
    79         ASSERT(context->isWorkerContext());
     79        ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    8080        WorkerContext* workerContext = static_cast<WorkerContext*>(context);
    8181        // Notify parent that this context is closed. Parent is responsible for calling WorkerThread::stop().

  • trunk/Source/WebCore/workers/WorkerMessagingProxy.cpp

    r141466 r141783  
    6969    virtual void performTask(ScriptExecutionContext* scriptContext)
    7070    {
    71         ASSERT(scriptContext->isWorkerContext());
     71        ASSERT_WITH_SECURITY_IMPLICATION(scriptContext->isWorkerContext());
    7272        DedicatedWorkerContext* context = static_cast<DedicatedWorkerContext*>(scriptContext);
    7373        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
    … …  
    375375static void connectToWorkerContextInspectorTask(ScriptExecutionContext* context, bool)
    376376{
    377     ASSERT(context->isWorkerContext());
     377    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    378378    static_cast<WorkerContext*>(context)->workerInspectorController()->connectFrontend();
    379379}
    … …  
    394394static void disconnectFromWorkerContextInspectorTask(ScriptExecutionContext* context, bool)
    395395{
    396     ASSERT(context->isWorkerContext());
     396    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    397397    static_cast<WorkerContext*>(context)->workerInspectorController()->disconnectFrontend();
    398398}
    … …  
    412412static void dispatchOnInspectorBackendTask(ScriptExecutionContext* context, const String& message)
    413413{
    414     ASSERT(context->isWorkerContext());
     414    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    415415    static_cast<WorkerContext*>(context)->workerInspectorController()->dispatchMessageFromFrontend(message);
    416416}

  • trunk/Source/WebCore/workers/WorkerScriptLoader.cpp

    r127227 r141783  
    7070        return;
    7171
    72     ASSERT(scriptExecutionContext->isWorkerContext());
     72    ASSERT_WITH_SECURITY_IMPLICATION(scriptExecutionContext->isWorkerContext());
    7373
    7474    ThreadableLoaderOptions options;

  • trunk/Source/WebCore/workers/WorkerThread.cpp

    r140483 r141783  
    208208    virtual void performTask(ScriptExecutionContext *context)
    209209    {
    210         ASSERT(context->isWorkerContext());
     210        ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    211211        WorkerContext* workerContext = static_cast<WorkerContext*>(context);
    212212#if ENABLE(INSPECTOR)
    … …  
    229229    virtual void performTask(ScriptExecutionContext *context)
    230230    {
    231         ASSERT(context->isWorkerContext());
     231        ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    232232        WorkerContext* workerContext = static_cast<WorkerContext*>(context);
    233233

  • trunk/Source/WebKit/blackberry/Api/WebPage.cpp

    r141773 r141783  
    40264026            // We do focus <select>/<option> on mouse down so that a Focus event is fired and have the
    40274027            // element painted in its focus state on repaint.
    4028             ASSERT(node->isElementNode());
     4028            ASSERT_WITH_SECURITY_IMPLICATION(node->isElementNode());
    40294029            if (node->isElementNode()) {
    40304030                Element* element = static_cast<Element*>(node);

  • trunk/Source/WebKit/blackberry/ChangeLog

    r141773 r141783  
     12013-02-04  Abhishek Arya  <inferno@chromium.org>
     2
     3        Add ASSERT_WITH_SECURITY_IMPLICATION to detect bad cast in DOM, CSS, etc.
     4        https://bugs.webkit.org/show_bug.cgi?id=108688
     5
     6        Reviewed by Eric Seidel.
     7
     8        * Api/WebPage.cpp:
     9        (BlackBerry::WebKit::WebPagePrivate::handleMouseEvent):
     10        * WebKitSupport/FatFingers.cpp:
     11        (BlackBerry::WebKit::FatFingers::setSuccessfulFatFingersResult):
     12
    1132013-02-04  Andrew Lo  <anlo@rim.com>
    214

  • trunk/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp

    r140282 r141783  
    479479    bool isTextInputElement = false;
    480480    if (m_targetType == ClickableElement) {
    481         ASSERT(bestNode->isElementNode());
     481        ASSERT_WITH_SECURITY_IMPLICATION(bestNode->isElementNode());
    482482        Element* bestElement = static_cast<Element*>(bestNode);
    483483        isTextInputElement = DOMSupport::isTextInputElement(bestElement);

  • trunk/Source/WebKit/chromium/ChangeLog

    r141769 r141783  
     12013-02-04  Abhishek Arya  <inferno@chromium.org>
     2
     3        Add ASSERT_WITH_SECURITY_IMPLICATION to detect bad cast in DOM, CSS, etc.
     4        https://bugs.webkit.org/show_bug.cgi?id=108688
     5
     6        Reviewed by Eric Seidel.
     7
     8        * src/IDBFactoryBackendProxy.cpp:
     9        (WebKit::IDBFactoryBackendProxy::allowIndexedDB):
     10        (WebKit::getWebFrame):
     11        * src/LocalFileSystemChromium.cpp:
     12        (WebCore::LocalFileSystem::deleteFileSystem):
     13        * src/WebSharedWorkerImpl.cpp:
     14        (WebKit::WebSharedWorkerImpl::connectTask):
     15        (WebKit::resumeWorkerContextTask):
     16        (WebKit::connectToWorkerContextInspectorTask):
     17        (WebKit::reconnectToWorkerContextInspectorTask):
     18        (WebKit::disconnectFromWorkerContextInspectorTask):
     19        (WebKit::dispatchOnInspectorBackendTask):
     20
    1212013-02-04  Sami Kyostila  <skyostil@chromium.org>
    222

  • trunk/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp

    r139666 r141783  
    164164{
    165165    bool allowed;
    166     ASSERT(context->isDocument() || context->isWorkerContext());
     166    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument() || context->isWorkerContext());
    167167    if (context->isDocument()) {
    168168        Document* document = static_cast<Document*>(context);
    … …  
    196196static WebFrameImpl* getWebFrame(ScriptExecutionContext* context)
    197197{
    198     ASSERT(context->isDocument() || context->isWorkerContext());
     198    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument() || context->isWorkerContext());
    199199    if (context->isDocument()) {
    200200        Document* document = static_cast<Document*>(context);

  • trunk/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp

    r138693 r141783  
    234234{
    235235    ASSERT(context);
    236     ASSERT(context->isDocument());
     236    ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
    237237
    238238    Document* document = static_cast<Document*>(context);

  • trunk/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp

    r138693 r141783  
    358358    RefPtr<MessagePort> port = MessagePort::create(*context);
    359359    port->entangle(channel);
    360     ASSERT(context->isWorkerContext());
     360    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    361361    WorkerContext* workerContext = static_cast<WorkerContext*>(context);
    362     ASSERT(workerContext->isSharedWorkerContext());
     362    ASSERT_WITH_SECURITY_IMPLICATION(workerContext->isSharedWorkerContext());
    363363    workerContext->dispatchEvent(createConnectEvent(port));
    364364}
    … …  
    397397static void resumeWorkerContextTask(ScriptExecutionContext* context, bool)
    398398{
    399     ASSERT(context->isWorkerContext());
     399    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    400400    static_cast<WorkerContext*>(context)->workerInspectorController()->resume();
    401401}
    … …  
    410410static void connectToWorkerContextInspectorTask(ScriptExecutionContext* context, bool)
    411411{
    412     ASSERT(context->isWorkerContext());
     412    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    413413    static_cast<WorkerContext*>(context)->workerInspectorController()->connectFrontend();
    414414}
    … …  
    421421static void reconnectToWorkerContextInspectorTask(ScriptExecutionContext* context, const String& savedState)
    422422{
    423     ASSERT(context->isWorkerContext());
     423    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    424424    WorkerInspectorController* ic = static_cast<WorkerContext*>(context)->workerInspectorController();
    425425    ic->restoreInspectorStateFromCookie(savedState);
    … …  
    434434static void disconnectFromWorkerContextInspectorTask(ScriptExecutionContext* context, bool)
    435435{
    436     ASSERT(context->isWorkerContext());
     436    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    437437    static_cast<WorkerContext*>(context)->workerInspectorController()->disconnectFrontend();
    438438}
    … …  
    445445static void dispatchOnInspectorBackendTask(ScriptExecutionContext* context, const String& message)
    446446{
    447     ASSERT(context->isWorkerContext());
     447    ASSERT_WITH_SECURITY_IMPLICATION(context->isWorkerContext());
    448448    static_cast<WorkerContext*>(context)->workerInspectorController()->dispatchMessageFromFrontend(message);
    449449}

  • trunk/Source/WebKit/qt/ChangeLog

    r141736 r141783  
     12013-02-04  Abhishek Arya  <inferno@chromium.org>
     2
     3        Add ASSERT_WITH_SECURITY_IMPLICATION to detect bad cast in DOM, CSS, etc.
     4        https://bugs.webkit.org/show_bug.cgi?id=108688
     5
     6        Reviewed by Eric Seidel.
     7
     8        * WebCoreSupport/FrameLoaderClientQt.cpp:
     9
    1102013-02-03  KwangYong Choi  <ky0.choi@samsung.com>
    211

  • trunk/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp

    r141567 r141783  
    14231423        QRect clipRect;
    14241424        if (parentScrollView) {
    1425             ASSERT(parentScrollView->isFrameView());
     1425            ASSERT_WITH_SECURITY_IMPLICATION(parentScrollView->isFrameView());
    14261426            clipRect = static_cast<FrameView*>(parentScrollView)->windowClipRect();
    14271427            clipRect.translate(-windowRect.x(), -windowRect.y());
Note: See TracChangeset for help on using the changeset viewer.