Changeset 88549 in webkit

Timestamp:

Jun 10, 2011 10:31:29 AM (13 years ago)

Author:

inferno@chromium.org

Message:

2011-06-10 Abhishek Arya <​inferno@chromium.org>

Reviewed by Tony Gentilcore.

Tests that trying to remove all document children while building a svg <use>
element shadow and instance tree does not result in crash.
​https://bugs.webkit.org/show_bug.cgi?id=62225

• svg/dom/use-style-recalc-script-execute-crash-expected.txt: Added.
• svg/dom/use-style-recalc-script-execute-crash.html: Added.

2011-06-10 James Simonsen <​simonjam@chromium.org>

Reviewed by Tony Gentilcore.

Don't execute scripts in shadow SVG.
​https://bugs.webkit.org/show_bug.cgi?id=62225

Test: svg/dom/use-style-recalc-script-execute-crash.html

• dom/ScriptElement.cpp: (WebCore::ScriptElement::prepareScript):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/dom/use-style-recalc-script-execute-crash-expected.txt (added)
• LayoutTests/svg/dom/use-style-recalc-script-execute-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ScriptElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-06-10  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Tests that trying to remove all document children while building a svg <use>
+        element shadow and instance tree does not result in crash.
+        https://bugs.webkit.org/show_bug.cgi?id=62225
+
+        * svg/dom/use-style-recalc-script-execute-crash-expected.txt: Added.
+        * svg/dom/use-style-recalc-script-execute-crash.html: Added.
+
 2011-06-10  Dimitri Glazkov  <dglazkov@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-06-10  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Don't execute scripts in shadow SVG.
+        https://bugs.webkit.org/show_bug.cgi?id=62225
+
+        Test: svg/dom/use-style-recalc-script-execute-crash.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::prepareScript):
+
 2011-06-10  Konstantin Tokarev  <ktokarev@smartlabs.tv>
 

trunk/Source/WebCore/dom/ScriptElement.cpp

@@ -204 +204 @@
         return false;
 
+    // FIXME: This is non-standard. Remove this after https://bugs.webkit.org/show_bug.cgi?id=62412.
+    Node* ancestor = m_element->parentNode();
+    while (ancestor) {
+        if (ancestor->isSVGShadowRoot())
+            return false;
+        ancestor = ancestor->parentNode();
+    }
+
     if (!isScriptForEventSupported())
         return false;