Changeset 199282 in webkit

Timestamp:

Apr 10, 2016 12:49:54 AM (8 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r165044 - REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
​https://bugs.webkit.org/show_bug.cgi?id=129550

Reviewed by Andreas Kling.

Source/WebCore:

We can't store a reference to QualifiedName here because ensureUniqueElementData could delete QualifiedName inside Attribute.

Test: fast/dom/uniquing-attributes-via-setAttribute.html

• dom/Element.cpp:

(WebCore::Element::setAttributeInternal):

LayoutTests:

Added a regression test.

• fast/dom/uniquing-attributes-via-setAttribute-expected.txt: Added.
• fast/dom/uniquing-attributes-via-setAttribute.html: Added.

Location:

releases/WebKitGTK/webkit-2.4

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/uniquing-attributes-via-setAttribute-expected.txt (added)
• LayoutTests/fast/dom/uniquing-attributes-via-setAttribute.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Element.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.4/LayoutTests/ChangeLog

@@ +1 @@
+2014-03-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=129550
+
+        Reviewed by Andreas Kling.
+
+        Added a regression test.
+
+        * fast/dom/uniquing-attributes-via-setAttribute-expected.txt: Added.
+        * fast/dom/uniquing-attributes-via-setAttribute.html: Added.
+
 2015-02-06  Zalan Bujtas  <zalan@apple.com>
 

releases/WebKitGTK/webkit-2.4/Source/WebCore/ChangeLog

@@ +1 @@
+2014-03-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=129550
+
+        Reviewed by Andreas Kling.
+
+        We can't store a reference to QualifiedName here because ensureUniqueElementData could delete QualifiedName inside Attribute.
+
+        Test: fast/dom/uniquing-attributes-via-setAttribute.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+
 2014-03-25  Gabor Rapcsanyi  <rgabor@webkit.org>
 

releases/WebKitGTK/webkit-2.4/Source/WebCore/dom/Element.cpp

@@ -1057 +1057 @@
     AtomicString oldValue = attribute.value();
     bool valueChanged = newValue != oldValue;
-    const QualifiedName& attributeName = (!inSynchronizationOfLazyAttribute || valueChanged) ? attribute.name() : name;
+    QualifiedName attributeName = (!inSynchronizationOfLazyAttribute || valueChanged) ? attribute.name() : name;
 
     if (!inSynchronizationOfLazyAttribute)