Changeset 87709 in webkit

Timestamp:

May 30, 2011 10:00:51 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-05-30 Andrey Petrov <​andrey.petrov@gmail.com>

Reviewed by Hajime Morita.

Using jQuery to show/hide IMG elements crashes WebKit
​https://bugs.webkit.org/show_bug.cgi?id=31721

• editing/pasteboard/copy-standalone-image-crash-expected.txt: Added.
• editing/pasteboard/copy-standalone-image-crash.html: Added.

2011-05-30 Andrey Petrov <​andrey.petrov@gmail.com>

Reviewed by Hajime Morita.

Using jQuery to show/hide IMG elements crashes WebKit
​https://bugs.webkit.org/show_bug.cgi?id=31721

For platform code, do not assert nodes always have renderer at
the time context menu action is invoked.
Renderer can actually be empty for a given node if it was hidden
or removed from domtree by some non-user generated event (e.g timeout)
after the popup menu had been created.

Changing Chromium, Gtk, Mac, Qt, Win and WinCE.

Test: editing/pasteboard/copy-standalone-image-crash.html

• platform/chromium/PasteboardChromium.cpp: (WebCore::Pasteboard::writeImage):
• platform/gtk/PasteboardGtk.cpp: (WebCore::Pasteboard::writeImage):
• platform/mac/PasteboardMac.mm: (WebCore::Pasteboard::writeImage):
• platform/qt/PasteboardQt.cpp: (WebCore::Pasteboard::writeImage):
• platform/win/PasteboardWin.cpp: (WebCore::Pasteboard::writeImage):
• platform/wince/PasteboardWinCE.cpp: (WebCore::Pasteboard::writeImage):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/pasteboard/copy-standalone-image-crash-expected.txt (added)
• LayoutTests/editing/pasteboard/copy-standalone-image-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/chromium/PasteboardChromium.cpp (modified) (2 diffs)
• Source/WebCore/platform/gtk/PasteboardGtk.cpp (modified) (1 diff)
• Source/WebCore/platform/mac/PasteboardMac.mm (modified) (2 diffs)
• Source/WebCore/platform/qt/PasteboardQt.cpp (modified) (1 diff)
• Source/WebCore/platform/win/PasteboardWin.cpp (modified) (1 diff)
• Source/WebCore/platform/wince/PasteboardWinCE.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-05-30  Andrey Petrov  <andrey.petrov@gmail.com>
+
+        Reviewed by Hajime Morita.
+
+        Using jQuery to show/hide IMG elements crashes WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=31721
+
+        * editing/pasteboard/copy-standalone-image-crash-expected.txt: Added.
+        * editing/pasteboard/copy-standalone-image-crash.html: Added.
+
 2011-05-30  Kent Tamura  <tkent@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-05-30  Andrey Petrov  <andrey.petrov@gmail.com>
+
+        Reviewed by Hajime Morita.
+
+        Using jQuery to show/hide IMG elements crashes WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=31721
+
+        For platform code, do not assert nodes always have renderer at
+        the time context menu action is invoked.
+        Renderer can actually be empty for a given node if it was hidden
+        or removed from domtree by some non-user generated event (e.g timeout) 
+        after the popup menu had been created.
+
+        Changing Chromium, Gtk, Mac, Qt, Win and WinCE.
+
+        Test: editing/pasteboard/copy-standalone-image-crash.html
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/wince/PasteboardWinCE.cpp:
+        (WebCore::Pasteboard::writeImage):
+
 2011-05-30  Daniel Bates  <dbates@webkit.org>
 

trunk/Source/WebCore/platform/chromium/PasteboardChromium.cpp

@@ -123 +123 @@
 {
     ASSERT(node);
-    ASSERT(node->renderer());
-    ASSERT(node->renderer()->isImage());
+
+    if (!(node->renderer() && node->renderer()->isImage()))
+        return;
+
     RenderImage* renderer = toRenderImage(node->renderer());
     CachedImage* cachedImage = renderer->cachedImage();
@@ -131 +133 @@
     Image* image = cachedImage->image();
     ASSERT(image);
-    
+
     NativeImagePtr bitmap = image->nativeImageForCurrentFrame();
     if (!bitmap)

trunk/Source/WebCore/platform/gtk/PasteboardGtk.cpp

@@ -119 +119 @@
 {
     ASSERT(node);
-    ASSERT(node->renderer());
+
+    if (!(node->renderer() && node->renderer()->isImage()))
+        return;
+
     RenderImage* renderer = toRenderImage(node->renderer());
     CachedImage* cachedImage = renderer->cachedImage();

trunk/Source/WebCore/platform/mac/PasteboardMac.mm

@@ -292 +292 @@
 {
     ASSERT(node);
+
+    if (!(node->renderer() && node->renderer()->isImage()))
+        return;
+
     Frame* frame = node->document()->frame();
 
@@ -297 +301 @@
     ASSERT(cocoaURL);
 
-    ASSERT(node->renderer() && node->renderer()->isImage());
     RenderImage* renderer = toRenderImage(node->renderer());
     CachedImage* cachedImage = renderer->cachedImage();

trunk/Source/WebCore/platform/qt/PasteboardQt.cpp

@@ -153 +153 @@
 void Pasteboard::writeImage(Node* node, const KURL&, const String&)
 {
-    ASSERT(node && node->renderer() && node->renderer()->isImage());
+    ASSERT(node);
+
+    if (!(node->renderer() && node->renderer()->isImage()))
+        return;
 
 #ifndef QT_NO_CLIPBOARD

trunk/Source/WebCore/platform/win/PasteboardWin.cpp

@@ -209 +209 @@
 void Pasteboard::writeImage(Node* node, const KURL&, const String&)
 {
-    ASSERT(node && node->renderer() && node->renderer()->isImage());
+    ASSERT(node);
+
+    if (!(node->renderer() && node->renderer()->isImage()))
+        return;
+
     RenderImage* renderer = toRenderImage(node->renderer());
     CachedImage* cachedImage = renderer->cachedImage();

trunk/Source/WebCore/platform/wince/PasteboardWinCE.cpp

@@ -201 +201 @@
 void Pasteboard::writeImage(Node* node, const KURL&, const String&)
 {
-    ASSERT(node && node->renderer() && node->renderer()->isImage());
+    ASSERT(node);
+
+    if (!(node->renderer() && node->renderer()->isImage()))
+        return;
+
     RenderImage* renderer = static_cast<RenderImage*>(node->renderer());
     CachedImage* cachedImage = static_cast<CachedImage*>(renderer->cachedImage());