git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: cf4a2dd)
REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 4 Mar 2014 09:45:55 +0000 (09:45 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 4 Mar 2014 09:45:55 +0000 (09:45 +0000)
https://bugs.webkit.org/show_bug.cgi?id=129550

Reviewed by Andreas Kling.

Source/WebCore:

We can't store a reference to QualifiedName here because ensureUniqueElementData could delete QualifiedName inside Attribute.

Test: fast/dom/uniquing-attributes-via-setAttribute.html

* dom/Element.cpp:
(WebCore::Element::setAttributeInternal):

LayoutTests:

Added a regression test.

* fast/dom/uniquing-attributes-via-setAttribute-expected.txt: Added.
* fast/dom/uniquing-attributes-via-setAttribute.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@165044 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/dom/uniquing-attributes-via-setAttribute-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/dom/uniquing-attributes-via-setAttribute.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/dom/Element.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index bac652183355bc9bbe4a2fd02b7ffb85400b8018..af8afea06ef11cf1c6861486d63ecf83fe2034db 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2014-03-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=129550
+
+        Reviewed by Andreas Kling.
+
+        Added a regression test.
+
+        * fast/dom/uniquing-attributes-via-setAttribute-expected.txt: Added.
+        * fast/dom/uniquing-attributes-via-setAttribute.html: Added.
+
 2014-03-03  Myles C. Maxfield  <mmaxfield@apple.com>
 
         Space between double underlines does not scale with font size
diff --git a/LayoutTests/fast/dom/uniquing-attributes-via-setAttribute-expected.txt b/LayoutTests/fast/dom/uniquing-attributes-via-setAttribute-expected.txt
new file mode 100644 (file)
index 0000000..a7f42af
--- /dev/null
+++ b/LayoutTests/fast/dom/uniquing-attributes-via-setAttribute-expected.txt
@@ -0,0 +1,3 @@
+Tests uniquing attributes via setAttribute. WebKit shouldn't crash under GuardMalloc or ASAN builds.
+
+PASS. WebKit didn't crash.
diff --git a/LayoutTests/fast/dom/uniquing-attributes-via-setAttribute.html b/LayoutTests/fast/dom/uniquing-attributes-via-setAttribute.html
new file mode 100644 (file)
index 0000000..a8064c5
--- /dev/null
+++ b/LayoutTests/fast/dom/uniquing-attributes-via-setAttribute.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Tests uniquing attributes via setAttribute. WebKit shouldn't crash under GuardMalloc or ASAN builds.</p>
+<div></div>
+<script>
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var div = document.querySelector('div');
+div.setAttribute('name', 'a');
+
+var divClone = div.cloneNode(true);
+document.body.appendChild(divClone);
+
+div.setAttribute('name', 'b');
+divClone.setAttribute('name', 'b');
+
+document.write("PASS. WebKit didn't crash.");
+
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index d9b677b3601ecedd676f28dbb525354a0b247342..91cf7d570294f0c595898b4a6b7feb86f741b2b4 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2014-03-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=129550
+
+        Reviewed by Andreas Kling.
+
+        We can't store a reference to QualifiedName here because ensureUniqueElementData could delete QualifiedName inside Attribute.
+
+        Test: fast/dom/uniquing-attributes-via-setAttribute.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+
 2014-03-04  Hyowon Kim  <hw1008.kim@samsung.com>
 
         Move EvasGLContext and EvasGLSurface files into the efl common directory.
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index ceedeb4945fb8d59d24e3502ebe642d0202aa36c..8b855bb6a3de4fff62b9e8ad81ceeb9c6acba3f7 100644 (file)
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -1029,7 +1029,7 @@ inline void Element::setAttributeInternal(unsigned index, const QualifiedName& n
     const Attribute& attribute = attributeAt(index);
     AtomicString oldValue = attribute.value();
     bool valueChanged = newValue != oldValue;
-    const QualifiedName& attributeName = (!inSynchronizationOfLazyAttribute || valueChanged) ? attribute.name() : name;
+    QualifiedName attributeName = (!inSynchronizationOfLazyAttribute || valueChanged) ? attribute.name() : name;
 
     if (!inSynchronizationOfLazyAttribute)
         willModifyAttribute(attributeName, oldValue, newValue);
Mirror of the WebKit open source project from svn.webkit.org.