[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.3-2-60-g76add97
Gustavo Noronha Silva
gns at gnome.org
Sun Oct 17 22:27:23 UTC 2010
The following commit has been merged in the debian/unstable branch:
commit fb4d89c467a548e6911e35555c660c9aa82533e3
Author: steveblock at google.com <steveblock at google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Aug 17 23:05:42 2010 +0000
2010-08-17 Steve Block <steveblock at google.com>
Reviewed by Jeremy Orlow.
Geolocation clearWatch() needs to protect against invalid IDs
https://bugs.webkit.org/show_bug.cgi?id=44096
* fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt: Added.
* fast/dom/Geolocation/clear-watch-invalid-id-crash.html: Added.
* fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js: Added.
* fast/dom/Geolocation/script-tests/notimer-after-unload.js:
(document.body.onload):
2010-08-17 Steve Block <steveblock at google.com>
Reviewed by Jeremy Orlow.
Geolocation clearWatch() needs to protect against invalid IDs
https://bugs.webkit.org/show_bug.cgi?id=44096
If the ID passed to clearWatch() is invalid, we early-out.
Test: fast/dom/Geolocation/clear-watch-invalid-id-crash.html
* page/Geolocation.cpp:
(WebCore::Geolocation::Watchers::set):
(WebCore::Geolocation::Watchers::remove):
(WebCore::Geolocation::watchPosition):
(WebCore::Geolocation::clearWatch):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@65570 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index cae229c..2efb1ba 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2010-08-17 Steve Block <steveblock at google.com>
+
+ Reviewed by Jeremy Orlow.
+
+ Geolocation clearWatch() needs to protect against invalid IDs
+ https://bugs.webkit.org/show_bug.cgi?id=44096
+
+ * fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt: Added.
+ * fast/dom/Geolocation/clear-watch-invalid-id-crash.html: Added.
+ * fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js: Added.
+ * fast/dom/Geolocation/script-tests/notimer-after-unload.js:
+ (document.body.onload):
+
2010-07-20 Abhishek Arya <inferno at chromium.org>
Reviewed by David Hyatt.
diff --git a/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt
new file mode 100644
index 0000000..f2e7f90
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt
@@ -0,0 +1 @@
+TEST COMPLETE
diff --git a/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash.html b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash.html
new file mode 100644
index 0000000..bf492ec
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/clear-watch-invalid-id-crash.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js b/LayoutTests/fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js
new file mode 100644
index 0000000..6176da0
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js
@@ -0,0 +1,14 @@
+description("Tests for a crash when clearWatch() is called with a zero ID.<br><br>We call clearWatch() with a request in progress then navigate the page. This accesses the watchers map during cleanup and triggers the crash. This page should not be visible when the test completes.");
+
+if (window.layoutTestController) {
+ layoutTestController.setGeolocationPermission(true);
+ layoutTestController.setMockGeolocationPosition(51.478, -0.166, 100);
+} else
+ debug('This test can not be run without the LayoutTestController');
+
+navigator.geolocation.watchPosition(function() {});
+navigator.geolocation.clearWatch(0);
+location = "data:text/html,TEST COMPLETE<script>layoutTestController.notifyDone();</script>";
+
+window.jsTestIsAsync = true;
+window.successfullyParsed = true;
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 51879b8..39a1922 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2010-08-17 Steve Block <steveblock at google.com>
+
+ Reviewed by Jeremy Orlow.
+
+ Geolocation clearWatch() needs to protect against invalid IDs
+ https://bugs.webkit.org/show_bug.cgi?id=44096
+
+ If the ID passed to clearWatch() is invalid, we early-out.
+
+ Test: fast/dom/Geolocation/clear-watch-invalid-id-crash.html
+
+ * page/Geolocation.cpp:
+ (WebCore::Geolocation::Watchers::set):
+ (WebCore::Geolocation::Watchers::remove):
+ (WebCore::Geolocation::watchPosition):
+ (WebCore::Geolocation::clearWatch):
+
2010-07-20 Abhishek Arya <inferno at chromium.org>
Reviewed by David Hyatt.
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 9acbc7f..d45518c 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -46,6 +46,8 @@ namespace WebCore {
static const char permissionDeniedErrorMessage[] = "User denied Geolocation";
static const char failedToStartServiceErrorMessage[] = "Failed to start Geolocation service";
+static const int firstAvailableWatchId = 1;
+
#if ENABLE(CLIENT_BASED_GEOLOCATION)
static PassRefPtr<Geoposition> createGeoposition(GeolocationPosition* position)
@@ -153,6 +155,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
{
+ ASSERT(id > 0);
RefPtr<GeoNotifier> notifier = prpNotifier;
m_idToNotifierMap.set(id, notifier.get());
@@ -161,6 +164,7 @@ void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
void Geolocation::Watchers::remove(int id)
{
+ ASSERT(id > 0);
IdToNotifierMap::iterator iter = m_idToNotifierMap.find(id);
if (iter == m_idToNotifierMap.end())
return;
@@ -263,7 +267,7 @@ int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, Pas
RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
ASSERT(notifier);
- static int nextAvailableWatchId = 1;
+ static int nextAvailableWatchId = firstAvailableWatchId;
// In case of overflow, make sure the ID remains positive, but reuse the ID values.
if (nextAvailableWatchId < 1)
nextAvailableWatchId = 1;
@@ -375,6 +379,9 @@ bool Geolocation::haveSuitableCachedPosition(PositionOptions* options)
void Geolocation::clearWatch(int watchId)
{
+ if (watchId < firstAvailableWatchId)
+ return;
+
m_watchers.remove(watchId);
if (!hasListeners())
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list