Changeset 95685 in webkit


Ignore:
Timestamp:
Sep 21, 2011 4:50:54 PM (13 years ago)
Author:
jchaffraix@webkit.org
Message:

Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled
​https://bugs.webkit.org/show_bug.cgi?id=68133

Reviewed by Darin Adler.

.:

  • Source/autotools/symbols.filter: Added the mangled symbols needed for window.internals

Source/WebCore:

Tests: fast/css/webkit-mask-crash-fieldset-legend.html

fast/css/webkit-mask-crash-figure.html
fast/css/webkit-mask-crash-table.html
fast/css/webkit-mask-crash-td-2.html
fast/css/webkit-mask-crash-td.html

GraphicsContext::getCTM crashes if called with a GraphicsContext that has painting
disabled. RenderBox::paintMaskImages would thus crash if called in this condition.

This change just modifies the different GraphicsContext::getCTM method to bail early
if painting is disabled on the GraphicsContext. The rest of the change is exposing
paintControlTints that exposes this.

  • WebCore.exp.in: Added symbols of the newly export window.internals function.
  • page/FrameView.cpp:

(WebCore::FrameView::updateControlTints): Split this function in 2 so that
I can expose the internal paintControlTints.

(WebCore::FrameView::paintControlTints):
This is the one exposed to Internals as we want to be testable regardless of
whether the platform supports control tints.

  • page/FrameView.h: Added paintControlTints.
  • testing/Internals.cpp:

(WebCore::Internals::paintControlTints):

  • testing/Internals.h:
  • testing/Internals.idl:

Added a way to force a fake painting so that we can easily reproduce the bugs.

  • platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::getCTM):

  • platform/graphics/cg/GraphicsContextCG.cpp:

(WebCore::GraphicsContext::getCTM):

  • platform/graphics/qt/GraphicsContextQt.cpp:

(WebCore::GraphicsContext::getCTM):

  • platform/graphics/skia/GraphicsContextSkia.cpp:

(WebCore::GraphicsContext::getCTM):

  • platform/graphics/wince/GraphicsContextWinCE.cpp:

(WebCore::GraphicsContext::getCTM):

  • platform/graphics/wx/GraphicsContextWx.cpp:

(WebCore::GraphicsContext::getCTM):
Fixed all our back-end to exit early if painting is disabled.

Source/WebKit2:

  • win/WebKit2.def:
  • win/WebKit2CFLite.def:

Exported the new FrameView::paintControlTints function.

LayoutTests:

Those tests checks that we do not crash when calling internals.paintControlTints.

  • platform/mac/Skipped: Skipped 2 tests as they are hitting an ASSERT unrelated to

this change on Mac.

  • fast/css/webkit-mask-crash-fieldset-legend-expected.txt: Added.
  • fast/css/webkit-mask-crash-fieldset-legend.html: Added.
  • fast/css/webkit-mask-crash-figure-expected.txt: Added.
  • fast/css/webkit-mask-crash-figure.html: Added.
  • fast/css/webkit-mask-crash-table-expected.txt: Added.
  • fast/css/webkit-mask-crash-table.html: Added.
  • fast/css/webkit-mask-crash-td-2-expected.txt: Added.
  • fast/css/webkit-mask-crash-td-2.html: Added.
  • fast/css/webkit-mask-crash-td-expected.txt: Added.
  • fast/css/webkit-mask-crash-td.html: Added.
Location:
trunk
Files:
10 added
21 edited

Legend:

Unmodified
Added
Removed

  • trunk/ChangeLog

    r95682 r95685  
     12011-09-21  Julien Chaffraix  <jchaffraix@webkit.org>
     2
     3        Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled
     4        https://bugs.webkit.org/show_bug.cgi?id=68133
     5
     6        Reviewed by Darin Adler.
     7
     8        * Source/autotools/symbols.filter: Added the mangled symbols needed for window.internals
     9
    1102011-09-21  Joshua Bell  <jsbell@chromium.org>
    211

  • trunk/LayoutTests/ChangeLog

    r95674 r95685  
     12011-09-21  Julien Chaffraix  <jchaffraix@webkit.org>
     2
     3        Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled
     4        https://bugs.webkit.org/show_bug.cgi?id=68133
     5
     6        Reviewed by Darin Adler.
     7
     8        Those tests checks that we do not crash when calling internals.paintControlTints.
     9
     10        * platform/mac/Skipped: Skipped 2 tests as they are hitting an ASSERT unrelated to
     11        this change on Mac.
     12
     13        * fast/css/webkit-mask-crash-fieldset-legend-expected.txt: Added.
     14        * fast/css/webkit-mask-crash-fieldset-legend.html: Added.
     15        * fast/css/webkit-mask-crash-figure-expected.txt: Added.
     16        * fast/css/webkit-mask-crash-figure.html: Added.
     17        * fast/css/webkit-mask-crash-table-expected.txt: Added.
     18        * fast/css/webkit-mask-crash-table.html: Added.
     19        * fast/css/webkit-mask-crash-td-2-expected.txt: Added.
     20        * fast/css/webkit-mask-crash-td-2.html: Added.
     21        * fast/css/webkit-mask-crash-td-expected.txt: Added.
     22        * fast/css/webkit-mask-crash-td.html: Added.
     23
    1242011-09-21  Abhishek Arya  <inferno@chromium.org>
    225

  • trunk/LayoutTests/platform/mac/Skipped

    r95322 r95685  
    421421# https://bugs.webkit.org/show_bug.cgi?id=68278
    422422http/tests/history/back-with-fragment-change.php
     423
     424# https://bugs.webkit.org/show_bug.cgi?id=68566
     425fast/css/webkit-mask-crash-fieldset-legend.html
     426fast/css/webkit-mask-crash-table.html

  • trunk/Source/WebCore/ChangeLog

    r95678 r95685  
     12011-09-21  Julien Chaffraix  <jchaffraix@webkit.org>
     2
     3        Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled
     4        https://bugs.webkit.org/show_bug.cgi?id=68133
     5
     6        Reviewed by Darin Adler.
     7
     8        Tests: fast/css/webkit-mask-crash-fieldset-legend.html
     9               fast/css/webkit-mask-crash-figure.html
     10               fast/css/webkit-mask-crash-table.html
     11               fast/css/webkit-mask-crash-td-2.html
     12               fast/css/webkit-mask-crash-td.html
     13
     14        GraphicsContext::getCTM crashes if called with a GraphicsContext that has painting
     15        disabled. RenderBox::paintMaskImages would thus crash if called in this condition.
     16
     17        This change just modifies the different GraphicsContext::getCTM method to bail early
     18        if painting is disabled on the GraphicsContext. The rest of the change is exposing
     19        paintControlTints that exposes this.
     20
     21        * WebCore.exp.in: Added symbols of the newly export window.internals function.
     22
     23        * page/FrameView.cpp:
     24        (WebCore::FrameView::updateControlTints): Split this function in 2 so that
     25        I can expose the internal paintControlTints.
     26
     27        (WebCore::FrameView::paintControlTints):
     28        This is the one exposed to Internals as we want to be testable regardless of
     29        whether the platform supports control tints.
     30
     31        * page/FrameView.h: Added paintControlTints.
     32
     33        * testing/Internals.cpp:
     34        (WebCore::Internals::paintControlTints):
     35        * testing/Internals.h:
     36        * testing/Internals.idl:
     37        Added a way to force a fake painting so that we can easily reproduce the bugs.
     38
     39        * platform/graphics/cairo/GraphicsContextCairo.cpp:
     40        (WebCore::GraphicsContext::getCTM):
     41        * platform/graphics/cg/GraphicsContextCG.cpp:
     42        (WebCore::GraphicsContext::getCTM):
     43        * platform/graphics/qt/GraphicsContextQt.cpp:
     44        (WebCore::GraphicsContext::getCTM):
     45        * platform/graphics/skia/GraphicsContextSkia.cpp:
     46        (WebCore::GraphicsContext::getCTM):
     47        * platform/graphics/wince/GraphicsContextWinCE.cpp:
     48        (WebCore::GraphicsContext::getCTM):
     49        * platform/graphics/wx/GraphicsContextWx.cpp:
     50        (WebCore::GraphicsContext::getCTM):
     51        Fixed all our back-end to exit early if painting is disabled.
     52
    1532011-09-19  Jer Noble  <jer.noble@apple.com>
    254

  • trunk/Source/WebCore/WebCore.exp.in

    r95513 r95685  
    986986__ZN7WebCore9FrameView6createEPNS_5FrameE
    987987__ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
     988__ZN7WebCore9FrameView17paintControlTintsEv
    988989__ZN7WebCore9HTMLNames10listingTagE
    989990__ZN7WebCore9HTMLNames11textareaTagE

  • trunk/Source/WebCore/page/FrameView.cpp

    r95612 r95685  
    26002600        return;
    26012601
    2602     if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())  {
    2603         if (needsLayout())
    2604             layout();
    2605         PlatformGraphicsContext* const noContext = 0;
    2606         GraphicsContext context(noContext);
    2607         context.setUpdatingControlTints(true);
    2608         if (platformWidget())
    2609             paintContents(&context, visibleContentRect());
    2610         else
    2611             paint(&context, frameRect());
    2612     }
     2602    if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())
     2603        paintControlTints();
     2604}
     2605
     2606void FrameView::paintControlTints()
     2607{
     2608    if (needsLayout())
     2609        layout();
     2610    PlatformGraphicsContext* const noContext = 0;
     2611    GraphicsContext context(noContext);
     2612    context.setUpdatingControlTints(true);
     2613    if (platformWidget())
     2614        paintContents(&context, visibleContentRect());
     2615    else
     2616        paint(&context, frameRect());
    26132617}
    26142618

  • trunk/Source/WebCore/page/FrameView.h

    r95249 r95685  
    5555public:
    5656    friend class RenderView;
     57    friend class Internals;
    5758
    5859    static PassRefPtr<FrameView> create(Frame*);
    … …  
    319320    void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
    320321
     322    void paintControlTints();
     323
    321324    void forceLayoutParentViewIfNeeded();
    322325    void performPostLayoutTasks();

  • trunk/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp

    r94897 r95685  
    197197AffineTransform GraphicsContext::getCTM() const
    198198{
     199    if (paintingDisabled())
     200        return AffineTransform();
     201
    199202    cairo_t* cr = platformContext()->cr();
    200203    cairo_matrix_t m;

  • trunk/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp

    r95207 r95685  
    12511251AffineTransform GraphicsContext::getCTM() const
    12521252{
     1253    if (paintingDisabled())
     1254        return AffineTransform();
     1255
    12531256    CGAffineTransform t = CGContextGetCTM(platformContext());
    12541257    return AffineTransform(t.a, t.b, t.c, t.d, t.tx, t.ty);

  • trunk/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp

    r94897 r95685  
    290290AffineTransform GraphicsContext::getCTM() const
    291291{
     292    if (paintingDisabled())
     293        return AffineTransform();
     294
    292295    const QTransform& matrix = platformContext()->combinedTransform();
    293296    return AffineTransform(matrix.m11(), matrix.m12(), matrix.m21(),

  • trunk/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp

    r95192 r95685  
    850850AffineTransform GraphicsContext::getCTM() const
    851851{
     852    if (paintingDisabled())
     853        return AffineTransform();
     854
    852855    const SkMatrix& m = platformContext()->canvas()->getTotalMatrix();
    853856    return AffineTransform(SkScalarToDouble(m.getScaleX()),

  • trunk/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp

    r94897 r95685  
    14951495AffineTransform GraphicsContext::getCTM() const
    14961496{
     1497    if (paintingDisabled())
     1498        return AffineTransform();
     1499
    14971500    return m_data->m_transform;
    14981501}

  • trunk/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp

    r94897 r95685  
    478478AffineTransform GraphicsContext::getCTM() const
    479479{
     480    if (paintingDisabled())
     481        return AffineTransform();
     482
    480483#if USE(WXGC)
    481484    wxGraphicsContext* gc = m_data->context->GetGraphicsContext();

  • trunk/Source/WebCore/testing/Internals.cpp

    r94789 r95685  
    366366}
    367367
    368 }
     368void Internals::paintControlTints(Document* document, ExceptionCode& ec)
     369{
     370    if (!document || !document->view()) {
     371        ec = INVALID_ACCESS_ERR;
     372        return;
     373    }
     374
     375    FrameView* frameView = document->view();
     376    frameView->paintControlTints();
     377}
     378
     379}

  • trunk/Source/WebCore/testing/Internals.h

    r94789 r95685  
    9191    static const char* internalsId;
    9292
     93    void paintControlTints(Document*, ExceptionCode&);
     94
    9395private:
    9496    Internals();

  • trunk/Source/WebCore/testing/Internals.idl

    r94789 r95685  
    6262        DOMString suggestedValue(in Element inputElement) raises (DOMException);
    6363        void setSuggestedValue(in Element inputElement, in DOMString value) raises (DOMException);
     64
     65        void paintControlTints(in Document document) raises (DOMException);
    6466    };
    6567}

  • trunk/Source/WebKit2/ChangeLog

    r95679 r95685  
     12011-09-21  Julien Chaffraix  <jchaffraix@webkit.org>
     2
     3        Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled
     4        https://bugs.webkit.org/show_bug.cgi?id=68133
     5
     6        Reviewed by Darin Adler.
     7
     8        * win/WebKit2.def:
     9        * win/WebKit2CFLite.def:
     10        Exported the new FrameView::paintControlTints function.
     11
    1122011-09-21  Alexey Proskuryakov  <ap@apple.com>
    213

  • trunk/Source/WebKit2/win/WebKit2.def

    r94705 r95685  
    162162        ?memoryCache@WebCore@@YAPAVMemoryCache@1@XZ
    163163        ?page@Document@WebCore@@QBEPAVPage@2@XZ
     164        ?paintControlTints@FrameView@WebCore@@AAEXXZ
    164165        ?removeShadowRoot@Element@WebCore@@QAEXXZ
    165166        ?setDisabled@MemoryCache@WebCore@@QAEX_N@Z

  • trunk/Source/WebKit2/win/WebKit2CFLite.def

    r94705 r95685  
    156156        ?memoryCache@WebCore@@YAPAVMemoryCache@1@XZ
    157157        ?page@Document@WebCore@@QBEPAVPage@2@XZ
     158        ?paintControlTints@FrameView@WebCore@@AAEXXZ
    158159        ?removeShadowRoot@Element@WebCore@@QAEXXZ
    159160        ?setDisabled@MemoryCache@WebCore@@QAEX_N@Z

  • trunk/Source/autotools/symbols.filter

    r94705 r95685  
    7777_ZN7WebCore14ScrollableArea28setScrollOffsetFromInternalsERKNS_8IntPointE;
    7878_ZN7WebCore10ScrollView23setScrollbarsSuppressedEbb;
     79_ZN7WebCore9FrameView17paintControlTintsEv;
    7980local:
    8081_Z*;
Note: See TracChangeset for help on using the changeset viewer.