Reviewed by Darin.

        Fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8272
        Use of window.open & window.close can cause crash

        * platform/PlatformMouseEvent.h:
        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
        * platform/mac/PlatformMouseEventMac.mm:
        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
        The default constructor now creates a "zero" event, and a new one was added to create the "current" one.

        * bridge/mac/FrameMac.mm:
        (WebCore::FrameMac::handleMouseMoveEvent):
        * rendering/RenderFormElement.cpp:
        (WebCore::RenderFormElement::clicked):
        Updated for the above changes.

        * platform/gdk/MouseEventGdk.cpp:
        * platform/gdk/TemporaryLinkStubs.cpp:
        (PlatformMouseEvent::PlatformMouseEvent):
        * platform/win/MouseEventWin.cpp:
        * platform/win/TemporaryLinkStubs.cpp:
        (PlatformMouseEvent::PlatformMouseEvent):
        Trying not to break other platforms.

        * manual-tests/invalid-mouse-event.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15544 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index c22b1dcbdf59d679c24d7b362748b6d62a1d4f1d..6a0dac78888c2b2478f7bfaddf99b7e45663a2bf 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,32 @@
+2006-07-19  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        Fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8272
+        Use of window.open & window.close can cause crash
+
+        * platform/PlatformMouseEvent.h:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        The default constructor now creates a "zero" event, and a new one was added to create the "current" one.
+
+        * bridge/mac/FrameMac.mm:
+        (WebCore::FrameMac::handleMouseMoveEvent):
+        * rendering/RenderFormElement.cpp:
+        (WebCore::RenderFormElement::clicked): 
+        Updated for the above changes.
+
+        * platform/gdk/MouseEventGdk.cpp:
+        * platform/gdk/TemporaryLinkStubs.cpp:
+        (PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/MouseEventWin.cpp:
+        * platform/win/TemporaryLinkStubs.cpp:
+        (PlatformMouseEvent::PlatformMouseEvent):
+        Trying not to break other platforms.
+
+        * manual-tests/invalid-mouse-event.html: Added.
+
 2006-07-20  Maciej Stachowiak  <mjs@apple.com>
         
         Reviewed by Anders.

diff --git a/WebCore/bridge/mac/FrameMac.mm b/WebCore/bridge/mac/FrameMac.mm
index a587b93995e491aa26535506a480eb9b3acaf7e7..82ed4b269a5f776014d599042287542b2ecffb3c 100644 (file)
--- a/WebCore/bridge/mac/FrameMac.mm
+++ b/WebCore/bridge/mac/FrameMac.mm
@@ -1733,7 +1733,7 @@ void FrameMac::handleMouseMoveEvent(const MouseEventWithHitTestResults& event)
                     BOOL startedDrag = [_bridge startDraggingImage:dragImage at:dragLoc operation:srcOp event:_currentEvent sourceIsDHTML:_dragSrcIsDHTML DHTMLWroteData:wcWrotePasteboard];
                     if (!startedDrag && _dragSrcMayBeDHTML) {
                         // WebKit canned the drag at the last minute - we owe _dragSrc a DRAGEND event
-                        PlatformMouseEvent event;
+                        PlatformMouseEvent event(PlatformMouseEvent::currentEvent);
                         dispatchDragSrcEvent(dragendEvent, event);
                         _mouseDownMayStartDrag = false;
                     }

diff --git a/WebCore/manual-tests/invalid-mouse-event.html b/WebCore/manual-tests/invalid-mouse-event.html
new file mode 100644 (file)
index 0000000..44b3b9d
--- /dev/null
+++ b/WebCore/manual-tests/invalid-mouse-event.html
@@ -0,0 +1,23 @@
+<p>Test for <a href="http://bugzilla.opendarwin.org/show_bug.cgi?id=8272">bug 8272</a>:
+Use of window.open & window.close can cause crash.</p>
+<ol>
+  <li>(Get a dual processor Mac.)</li>
+  <li>Disable popup blocking in Safari.</li>
+  <li>Click the Start button.</li>
+  <li>As the test runs, move the mouse around.</li>
+  <li>If Safari doesn't crash in a while, interrupt the test by pressing Cmd+W.</li>
+</ol>
+
+<button onclick="window.open('invalid-mouse-event.html?2', '', '');">Start</button>
+
+<script>
+
+if (location.search) {
+  if (location.search == "?1") {
+    window.opener.location = window.opener.location;
+    window.close();
+  } else {
+    window.open('invalid-mouse-event.html?1', '', '');
+  }
+}
+</script>

diff --git a/WebCore/platform/PlatformMouseEvent.h b/WebCore/platform/PlatformMouseEvent.h
index a51e22ad5c89f949a4136340cb42c4efcb4859ed..13be8d161e82b13cdca2dafd9bd5aa5b1c441f57 100644 (file)
--- a/WebCore/platform/PlatformMouseEvent.h
+++ b/WebCore/platform/PlatformMouseEvent.h
@@ -53,7 +53,20 @@ namespace WebCore {
 
     class PlatformMouseEvent {
     public:
-        PlatformMouseEvent(); // "current event"
+        static const struct CurrentEventTag {} currentEvent;
+    
+        PlatformMouseEvent()
+            : m_button(LeftButton)
+            , m_clickCount(0)
+            , m_shiftKey(false)
+            , m_ctrlKey(false)
+            , m_altKey(false)
+            , m_metaKey(false)
+        {
+        }
+
+        PlatformMouseEvent(const CurrentEventTag&);
+
         PlatformMouseEvent(const IntPoint& pos, const IntPoint& globalPos, MouseButton button,
                            int clickCount, bool shift, bool ctrl, bool alt, bool meta)
             : m_position(pos), m_globalPosition(globalPos), m_button(button)

diff --git a/WebCore/platform/gdk/MouseEventGdk.cpp b/WebCore/platform/gdk/MouseEventGdk.cpp
index 93ee9348130a13082731ee8af874e9bf82b9fe0e..6fde2217b7422c94f2693b83193353555ba3dcee 100644 (file)
--- a/WebCore/platform/gdk/MouseEventGdk.cpp
+++ b/WebCore/platform/gdk/MouseEventGdk.cpp
@@ -32,6 +32,8 @@
 
 namespace WebCore {
 
+const PlatformMouseEvent::CurrentEventTag PlatformMouseEvent::currentEvent = {};
+
 // FIXME: Would be even better to figure out which modifier is Alt instead of always using GDK_MOD1_MASK.
 
 PlatformMouseEvent::PlatformMouseEvent(GdkEvent* event)

diff --git a/WebCore/platform/gdk/TemporaryLinkStubs.cpp b/WebCore/platform/gdk/TemporaryLinkStubs.cpp
index dfb546dce1d0b5eea2f71b4e62d2845179ce27a5..ffac985a529823c7dc7f71c1352502e03a66fe99 100644 (file)
--- a/WebCore/platform/gdk/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/gdk/TemporaryLinkStubs.cpp
@@ -157,7 +157,7 @@ Widget::FocusPolicy TextField::focusPolicy() const { notImplemented(); return No
 
 Cursor::Cursor(Image*) { notImplemented(); }
 
-PlatformMouseEvent::PlatformMouseEvent() { notImplemented(); }
+PlatformMouseEvent::PlatformMouseEvent(const CurrentEventTag&) { notImplemented(); }
 String WebCore::searchableIndexIntroduction() { notImplemented(); return String(); }
 
 int WebCore::findNextSentenceFromIndex(UChar const*, int, int, bool) { notImplemented(); return 0; }

diff --git a/WebCore/platform/mac/PlatformMouseEventMac.mm b/WebCore/platform/mac/PlatformMouseEventMac.mm
index 39be2f336a97ffcb5e9b525303d8d2ce465a7a53..aebc5b1e63c91732bd9d2a3d2e9a4cf9b3648155 100644 (file)
--- a/WebCore/platform/mac/PlatformMouseEventMac.mm
+++ b/WebCore/platform/mac/PlatformMouseEventMac.mm
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+const PlatformMouseEvent::CurrentEventTag PlatformMouseEvent::currentEvent = {};
+
 static MouseButton mouseButtonForEvent(NSEvent *event)
 {
     switch ([event type]) {
@@ -123,7 +125,7 @@ PlatformMouseEvent::PlatformMouseEvent(NSEvent* event)
 {
 }
 
-PlatformMouseEvent::PlatformMouseEvent()
+PlatformMouseEvent::PlatformMouseEvent(const CurrentEventTag&)
     : m_button(LeftButton), m_clickCount(0), m_shiftKey(false), m_ctrlKey(false), m_altKey(false), m_metaKey(false)
 {
     NSEvent* event = [NSApp currentEvent];

diff --git a/WebCore/platform/win/MouseEventWin.cpp b/WebCore/platform/win/MouseEventWin.cpp
index b1c1ad9487c4aba7dc74dbc0f46b789016a09fdb..e8233ba62fdc9b2a08aa2fe11d30d6f92b4d2499 100644 (file)
--- a/WebCore/platform/win/MouseEventWin.cpp
+++ b/WebCore/platform/win/MouseEventWin.cpp
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+const PlatformMouseEvent::CurrentEventTag PlatformMouseEvent::currentEvent = {};
+
 #define HIGH_BIT_MASK_SHORT 0x8000
 
 static IntPoint positionForEvent(HWND hWnd, LPARAM lParam)

diff --git a/WebCore/platform/win/TemporaryLinkStubs.cpp b/WebCore/platform/win/TemporaryLinkStubs.cpp
index 1c114f61bd60e0f816f3474e1d99bc4c1ca86c62..8f2910147cfb41ebe6e1097173df946c852f04eb 100644 (file)
--- a/WebCore/platform/win/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/win/TemporaryLinkStubs.cpp
@@ -155,7 +155,7 @@ Widget::FocusPolicy TextField::focusPolicy() const { notImplemented(); return No
 
 Cursor::Cursor(Image*) { notImplemented(); }
 
-PlatformMouseEvent::PlatformMouseEvent() { notImplemented(); }
+PlatformMouseEvent::PlatformMouseEvent(const CurrentEventTag&) { notImplemented(); }
 String WebCore::searchableIndexIntroduction() { notImplemented(); return String(); }
 
 int WebCore::findNextSentenceFromIndex(UChar const*,int,int,bool) { notImplemented(); return 0; }

diff --git a/WebCore/rendering/RenderFormElement.cpp b/WebCore/rendering/RenderFormElement.cpp
index 6d8e2b0f5ad550185c63d25f7e26a6ab7d3144e6..a5c0bf5c2d5e59c8077f19c91bc35e32150aeb4a 100644 (file)
--- a/WebCore/rendering/RenderFormElement.cpp
+++ b/WebCore/rendering/RenderFormElement.cpp
@@ -84,7 +84,7 @@ void RenderFormElement::layout()
 void RenderFormElement::clicked(Widget*)
 {
     RenderArena* arena = ref();
-    PlatformMouseEvent event; // gets "current event"
+    PlatformMouseEvent event(PlatformMouseEvent::currentEvent);
     if (node())
         static_cast<EventTargetNode*>(node())->dispatchMouseEvent(event, clickEvent, event.clickCount());
     deref(arena);