Changeset 62944 in webkit


Ignore:
Timestamp:
Jul 9, 2010 5:42:16 AM (14 years ago)
Author:
Nikolas Zimmermann
Message:

2010-07-09 Sheriff Bot <​webkit.review.bot@gmail.com>

Unreviewed, rolling out r62937.
​http://trac.webkit.org/changeset/62937
​https://bugs.webkit.org/show_bug.cgi?id=41955

Crashes SnowLeopard leaks and Windows debug bot in fast/xsl
/xslt-relative-path.xml, with assertion in
XSLTProcessorLibxslt.cpp:264 (Requested by WildFox on
#webkit).

  • xml/XSLTProcessor.h: (WebCore::XSLTProcessor::XSLTProcessor):
  • xml/XSLTProcessorLibxslt.cpp: (WebCore::docLoaderFunc): (WebCore::setXSLTLoadCallBack): (WebCore::xsltStylesheetPointer): (WebCore::XSLTProcessor::transformToString):
Location:
trunk/WebCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/WebCore/ChangeLog

    r62939 r62944  
     12010-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
     2
     3        Unreviewed, rolling out r62937.
     4        http://trac.webkit.org/changeset/62937
     5        https://bugs.webkit.org/show_bug.cgi?id=41955
     6
     7        Crashes SnowLeopard leaks and Windows debug bot in fast/xsl
     8        /xslt-relative-path.xml, with assertion in
     9        XSLTProcessorLibxslt.cpp:264 (Requested by WildFox on
     10        #webkit).
     11
     12        * xml/XSLTProcessor.h:
     13        (WebCore::XSLTProcessor::XSLTProcessor):
     14        * xml/XSLTProcessorLibxslt.cpp:
     15        (WebCore::docLoaderFunc):
     16        (WebCore::setXSLTLoadCallBack):
     17        (WebCore::xsltStylesheetPointer):
     18        (WebCore::XSLTProcessor::transformToString):
     19
    1202010-07-09  Yael Aharon  <yael.aharon@nokia.com>
    221

  • trunk/WebCore/xml/XSLTProcessor.h

    r62937 r62944  
    6868    // Only for libXSLT callbacks
    6969    XSLStyleSheet* xslStylesheet() const { return m_stylesheet.get(); }
    70     Node* sourceNode() const { return m_sourceNode; }
    7170#endif
    7271
    … …  
    7473
    7574private:
    76     XSLTProcessor() : m_sourceNode(0) { }
     75    XSLTProcessor() { }
    7776
    7877    RefPtr<XSLStyleSheet> m_stylesheet;
    7978    RefPtr<Node> m_stylesheetRootNode;
    8079    ParameterMap m_parameters;
    81 
    82     Node* m_sourceNode; // Source node is only non-null in transformToString(), so this cannot become a dangling pointer.
    8380};
    8481

  • trunk/WebCore/xml/XSLTProcessorLibxslt.cpp

    r62937 r62944  
    4646#include <libxslt/xsltutils.h>
    4747#include <wtf/Assertions.h>
    48 #include <wtf/HashSet.h>
    4948#include <wtf/text/CString.h>
    5049#include <wtf/Vector.h>
    … …  
    9695}
    9796
    98 static HashSet<XSLTProcessor*>& registeredXSLTProcessors()
    99 {
    100     DEFINE_STATIC_LOCAL(HashSet<XSLTProcessor*>, xsltProcessors, ());
    101     return xsltProcessors;
    102 }
    103 
    104 static HashSet<XSLStyleSheet*>& registeredXSLStyleSheets()
    105 {
    106     DEFINE_STATIC_LOCAL(HashSet<XSLStyleSheet*>, xslStyleSheets, ());
    107     return xslStyleSheets;
    108 }
    109 
     97// FIXME: There seems to be no way to control the ctxt pointer for loading here, thus we have globals.
     98static XSLTProcessor* globalProcessor = 0;
     99static DocLoader* globalDocLoader = 0;
    110100static xmlDocPtr docLoaderFunc(const xmlChar* uri,
    111101                                    xmlDictPtr,
    … …  
    114104                                    xsltLoadType type)
    115105{
     106    if (!globalProcessor)
     107        return 0;
     108
    116109    switch (type) {
    117110    case XSLT_LOAD_DOCUMENT: {
    118         xsltTransformContextPtr context = static_cast<xsltTransformContextPtr>(ctxt);
    119         XSLTProcessor* processor = static_cast<XSLTProcessor*>(context->_private);
    120         if (!processor || HashTraits<XSLTProcessor*>::isDeletedValue(processor)
    121             || !registeredXSLTProcessors().contains(processor)) {
    122             static bool errorMessagePrinted = false;
    123             if (!errorMessagePrinted) {
    124                 fprintf(stderr, "WebKit XSLT document loader was called with unknown transformation context.");
    125                 errorMessagePrinted = true;
    126             }
    127             return 0;
    128         }
    129 
    130         RefPtr<Document> ownerDocument = processor->sourceNode()->document();
    131         DocLoader* docLoader = ownerDocument->docLoader();
    132 
     111        xsltTransformContextPtr context = (xsltTransformContextPtr)ctxt;
    133112        xmlChar* base = xmlNodeGetBase(context->document->doc, context->node);
    134113        KURL url(KURL(ParsedURLString, reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
    … …  
    139118        Vector<char> data;
    140119
    141         bool requestAllowed = docLoader->frame() && docLoader->doc()->securityOrigin()->canRequest(url);
     120        bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
    142121        if (requestAllowed) {
    143             docLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
    144             requestAllowed = docLoader->doc()->securityOrigin()->canRequest(response.url());
     122            globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
     123            requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
    145124        }
    146125        if (!requestAllowed) {
    147126            data.clear();
    148             docLoader->printAccessDeniedMessage(url);
     127            globalDocLoader->printAccessDeniedMessage(url);
    149128        }
    150129
    151130        Console* console = 0;
    152         if (Frame* frame = processor->xslStylesheet()->ownerDocument()->frame())
     131        if (Frame* frame = globalProcessor->xslStylesheet()->ownerDocument()->frame())
    153132            console = frame->domWindow()->console();
    154133        xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
    … …  
    164143        return doc;
    165144    }
    166     case XSLT_LOAD_STYLESHEET: {
    167         xsltStylesheetPtr style = static_cast<xsltStylesheetPtr>(ctxt);
    168         XSLStyleSheet* xslStyleSheet = static_cast<XSLStyleSheet*>(style->doc->_private);
    169         if (!xslStyleSheet || HashTraits<XSLStyleSheet*>::isDeletedValue(xslStyleSheet)
    170             || !registeredXSLStyleSheets().contains(xslStyleSheet)) {
    171             static bool errorMessagePrinted = false;
    172             if (!errorMessagePrinted) {
    173                 fprintf(stderr, "WebKit XSLT document loader was called with unknown transformation context.");
    174                 errorMessagePrinted = true;
    175             }
    176             return 0;
    177         }
    178 
    179         xmlDocPtr result = xslStyleSheet->locateStylesheetSubResource(style->doc, uri);
    180         if (!result)
    181             return 0;
    182 
    183         // Save a pointer to the root stylesheet so that we can access it again from
    184         // this callback function if this xsl document imports another xsl document.
    185         ASSERT(!result->_private);
    186         result->_private = xslStyleSheet;
    187         return result;
    188     }
     145    case XSLT_LOAD_STYLESHEET:
     146        return globalProcessor->xslStylesheet()->locateStylesheetSubResource(((xsltStylesheetPtr)ctxt)->doc, uri);
    189147    default:
    190148        break;
    … …  
    192150
    193151    return 0;
     152}
     153
     154static inline void setXSLTLoadCallBack(xsltDocLoaderFunc func, XSLTProcessor* processor, DocLoader* loader)
     155{
     156    xsltSetLoaderFunc(func);
     157    globalProcessor = processor;
     158    globalDocLoader = loader;
    194159}
    195160
    … …  
    257222}
    258223
    259 static void clearSavedStyleSheetPointers(xsltStylesheetPtr style)
    260 {
    261     if (!style || !style->doc)
    262         return;
    263 
    264     ASSERT(style->doc->_private);
    265     style->doc->_private = 0;
    266 
    267     for (xsltStylesheetPtr import = style->imports; import; import = import->next)
    268         clearSavedStyleSheetPointers(import);
    269 }
    270 
    271224static xsltStylesheetPtr xsltStylesheetPointer(RefPtr<XSLStyleSheet>& cachedStylesheet, Node* stylesheetRootNode)
    272225{
    … …  
    278231    }
    279232
    280     if (!cachedStylesheet)
     233    if (!cachedStylesheet || !cachedStylesheet->document())
    281234        return 0;
    282235
    283     xmlDocPtr xslDocument = cachedStylesheet->document();
    284     if (!xslDocument)
    285         return 0;
    286 
    287     // Save a pointer to the stylesheet so that we can access it from the libxslt loader callback.
    288     void* old = xslDocument->_private;
    289     xslDocument->_private = cachedStylesheet.get();
    290     registeredXSLStyleSheets().add(cachedStylesheet.get());
    291 
    292     xsltStylesheetPtr result = cachedStylesheet->compileStyleSheet();
    293     registeredXSLStyleSheets().remove(cachedStylesheet.get());
    294     clearSavedStyleSheetPointers(result);
    295     xslDocument->_private = old;
    296     return result;
     236    return cachedStylesheet->compileStyleSheet();
    297237}
    298238
    … …  
    334274bool XSLTProcessor::transformToString(Node* sourceNode, String& mimeType, String& resultString, String& resultEncoding)
    335275{
    336     xsltSetLoaderFunc(docLoaderFunc);
     276    RefPtr<Document> ownerDocument = sourceNode->document();
     277
     278    setXSLTLoadCallBack(docLoaderFunc, this, ownerDocument->docLoader());
    337279    xsltStylesheetPtr sheet = xsltStylesheetPointer(m_stylesheet, m_stylesheetRootNode.get());
    338280    if (!sheet) {
    339         xsltSetLoaderFunc(0);
     281        setXSLTLoadCallBack(0, 0, 0);
    340282        return false;
    341283    }
    … …  
    356298        registerXSLTExtensions(transformContext);
    357299
    358         // Save a pointer to this XSLTProcessor so that we can access it from the libxslt loader callback.
    359         ASSERT(!transformContext->_private);
    360         transformContext->_private = this;
    361         registeredXSLTProcessors().add(this);
    362         m_sourceNode = sourceNode;
    363 
    364300        // <http://bugs.webkit.org/show_bug.cgi?id=16077>: XSLT processor <xsl:sort> algorithm only compares by code point.
    365301        xsltSetCtxtSortFunc(transformContext, xsltUnicodeSortFunction);
    … …  
    374310        xmlDocPtr resultDoc = xsltApplyStylesheetUser(sheet, sourceDoc, 0, 0, 0, transformContext);
    375311
    376         registeredXSLTProcessors().remove(this);
    377312        xsltFreeTransformContext(transformContext);
    378313        freeXsltParamArray(params);
    … …  
    389324
    390325    sheet->method = origMethod;
    391     xsltSetLoaderFunc(0);
     326    setXSLTLoadCallBack(0, 0, 0);
    392327    xsltFreeStylesheet(sheet);
    393328    m_stylesheet = 0;
    394     m_sourceNode = 0;
    395329
    396330    return success;
Note: See TracChangeset for help on using the changeset viewer.