Changeset 43237 in webkit

Timestamp:

May 5, 2009 8:41:41 AM (15 years ago)

Author:

eric@webkit.org

Message:

Reviewed by Adam Roben.

Fix mappedAttributes() access without NULL check
​https://bugs.webkit.org/show_bug.cgi?id=25553

SVGStyledElement::getPresentationAttribute was using mappedAttributes()
without checking for NULL.

HTMLInputElement::setInputType also doesn't NULL check, but I was not
able to get it to crash with a test case so I just added an ASSERT.

• html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::setInputType):
• svg/SVGStyledElement.cpp: (WebCore::SVGStyledElement::getPresentationAttribute):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/custom/path-getPresentationAttribute-crash-expected.txt (added)
• LayoutTests/svg/custom/path-getPresentationAttribute-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLInputElement.cpp (modified) (1 diff)
• WebCore/svg/SVGStyledElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Fix mappedAttributes() access without NULL check
+        https://bugs.webkit.org/show_bug.cgi?id=25553
+
+        * svg/custom/path-getPresentationAttribute-crash-expected.txt: Added.
+        * svg/custom/path-getPresentationAttribute-crash.html: Added.
+
 2009-05-04  Eric Seidel  <eric@webkit.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Fix mappedAttributes() access without NULL check
+        https://bugs.webkit.org/show_bug.cgi?id=25553
+
+        SVGStyledElement::getPresentationAttribute was using mappedAttributes()
+        without checking for NULL.
+
+        HTMLInputElement::setInputType also doesn't NULL check, but I was not
+        able to get it to crash with a test case so I just added an ASSERT.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
 2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
 

trunk/WebCore/html/HTMLInputElement.cpp

@@ -276 +276 @@
             if (didRespectHeightAndWidth != willRespectHeightAndWidth) {
                 NamedMappedAttrMap* map = mappedAttributes();
+                ASSERT(map);
                 if (Attribute* height = map->getAttributeItem(heightAttr))
                     attributeChanged(height, false);

trunk/WebCore/svg/SVGStyledElement.cpp

@@ -243 +243 @@
 PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& name)
 {
+    if (!mappedAttributes())
+        return 0;
+
     Attribute* attr = mappedAttributes()->getAttributeItem(QualifiedName(nullAtom, name, nullAtom));
     if (!attr || !attr->isMappedAttribute() || !attr->style())