[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.3-2-60-g76add97

Gustavo Noronha Silva gns at gnome.org
Sun Oct 17 22:27:23 UTC 2010


The following commit has been merged in the debian/unstable branch:
commit fb4d89c467a548e6911e35555c660c9aa82533e3
Author: steveblock at google.com <steveblock at google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Aug 17 23:05:42 2010 +0000

    2010-08-17  Steve Block  <steveblock at google.com>
    
            Reviewed by Jeremy Orlow.
    
            Geolocation clearWatch() needs to protect against invalid IDs
            https://bugs.webkit.org/show_bug.cgi?id=44096
    
            * fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt: Added.
            * fast/dom/Geolocation/clear-watch-invalid-id-crash.html: Added.
            * fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js: Added.
            * fast/dom/Geolocation/script-tests/notimer-after-unload.js:
            (document.body.onload):
    2010-08-17  Steve Block  <steveblock at google.com>
    
            Reviewed by Jeremy Orlow.
    
            Geolocation clearWatch() needs to protect against invalid IDs
            https://bugs.webkit.org/show_bug.cgi?id=44096
    
            If the ID passed to clearWatch() is invalid, we early-out.
    
            Test: fast/dom/Geolocation/clear-watch-invalid-id-crash.html
    
            * page/Geolocation.cpp:
            (WebCore::Geolocation::Watchers::set):
            (WebCore::Geolocation::Watchers::remove):
            (WebCore::Geolocation::watchPosition):
            (WebCore::Geolocation::clearWatch):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@65570 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index cae229c..2efb1ba 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2010-08-17  Steve Block  <steveblock at google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Geolocation clearWatch() needs to protect against invalid IDs
+        https://bugs.webkit.org/show_bug.cgi?id=44096
+
+        * fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt: Added.
+        * fast/dom/Geolocation/clear-watch-invalid-id-crash.html: Added.
+        * fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js: Added.
+        * fast/dom/Geolocation/script-tests/notimer-after-unload.js:
+        (document.body.onload):
+
 2010-07-20  Abhishek Arya  <inferno at chromium.org>
 
         Reviewed by David Hyatt.
diff --git a/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt
new file mode 100644
index 0000000..f2e7f90
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash-expected.txt
@@ -0,0 +1 @@
+TEST COMPLETE
diff --git a/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash.html b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash.html
new file mode 100644
index 0000000..bf492ec
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/clear-watch-invalid-id-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/clear-watch-invalid-id-crash.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js b/LayoutTests/fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js
new file mode 100644
index 0000000..6176da0
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/script-tests/clear-watch-invalid-id-crash.js
@@ -0,0 +1,14 @@
+description("Tests for a crash when clearWatch() is called with a zero ID.<br><br>We call clearWatch() with a request in progress then navigate the page. This accesses the watchers map during cleanup and triggers the crash. This page should not be visible when the test completes.");
+
+if (window.layoutTestController) {
+    layoutTestController.setGeolocationPermission(true);
+    layoutTestController.setMockGeolocationPosition(51.478, -0.166, 100);
+} else
+    debug('This test can not be run without the LayoutTestController');
+
+navigator.geolocation.watchPosition(function() {});
+navigator.geolocation.clearWatch(0);
+location = "data:text/html,TEST COMPLETE<script>layoutTestController.notifyDone();</script>";
+
+window.jsTestIsAsync = true;
+window.successfullyParsed = true;
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 51879b8..39a1922 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2010-08-17  Steve Block  <steveblock at google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Geolocation clearWatch() needs to protect against invalid IDs
+        https://bugs.webkit.org/show_bug.cgi?id=44096
+
+        If the ID passed to clearWatch() is invalid, we early-out.
+
+        Test: fast/dom/Geolocation/clear-watch-invalid-id-crash.html
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Watchers::set):
+        (WebCore::Geolocation::Watchers::remove):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::clearWatch):
+
 2010-07-20  Abhishek Arya  <inferno at chromium.org>
 
         Reviewed by David Hyatt.
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 9acbc7f..d45518c 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -46,6 +46,8 @@ namespace WebCore {
 static const char permissionDeniedErrorMessage[] = "User denied Geolocation";
 static const char failedToStartServiceErrorMessage[] = "Failed to start Geolocation service";
 
+static const int firstAvailableWatchId = 1;
+
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
 
 static PassRefPtr<Geoposition> createGeoposition(GeolocationPosition* position)
@@ -153,6 +155,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 
 void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 {
+    ASSERT(id > 0);
     RefPtr<GeoNotifier> notifier = prpNotifier;
 
     m_idToNotifierMap.set(id, notifier.get());
@@ -161,6 +164,7 @@ void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 
 void Geolocation::Watchers::remove(int id)
 {
+    ASSERT(id > 0);
     IdToNotifierMap::iterator iter = m_idToNotifierMap.find(id);
     if (iter == m_idToNotifierMap.end())
         return;
@@ -263,7 +267,7 @@ int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, Pas
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
 
-    static int nextAvailableWatchId = 1;
+    static int nextAvailableWatchId = firstAvailableWatchId;
     // In case of overflow, make sure the ID remains positive, but reuse the ID values.
     if (nextAvailableWatchId < 1)
         nextAvailableWatchId = 1;
@@ -375,6 +379,9 @@ bool Geolocation::haveSuitableCachedPosition(PositionOptions* options)
 
 void Geolocation::clearWatch(int watchId)
 {
+    if (watchId < firstAvailableWatchId)
+        return;
+
     m_watchers.remove(watchId);
     
     if (!hasListeners())

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list