Commit 32e92c57 authored by weinig@apple.com's avatar weinig@apple.com

WebCore:

2008-11-28  Sam Weinig  <sam@webkit.org>

        Reviewed by Alexey Proskuryakov.

        Fix for https://bugs.webkit.org/show_bug.cgi?id=21063
        NULL pointer crash in dispatchEvent(null);

        Test: fast/events/dispatchEvent-crash.html

        * dom/MessagePort.cpp:
        (WebCore::MessagePort::dispatchEvent):
        * dom/Worker.cpp:
        (WebCore::Worker::dispatchEvent):
        * dom/WorkerContext.cpp:
        (WebCore::WorkerContext::dispatchEvent):
        * loader/appcache/DOMApplicationCache.cpp:
        (WebCore::DOMApplicationCache::dispatchEvent):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::dispatchEvent):
        * xml/XMLHttpRequestUpload.cpp:
        (WebCore::XMLHttpRequestUpload::dispatchEvent):

LayoutTests:

2008-11-28  Sam Weinig  <sam@webkit.org>

        Reviewed by Alexey Proskuryakov.

        Test for https://bugs.webkit.org/show_bug.cgi?id=21063
        NULL pointer crash in dispatchEvent(null);

        * fast/events/dispatchEvent-crash-expected.txt: Added.
        * fast/events/dispatchEvent-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@38845 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 8cc9b619
2008-11-28 Sam Weinig <sam@webkit.org>
Reviewed by Alexey Proskuryakov.
Test for https://bugs.webkit.org/show_bug.cgi?id=21063
NULL pointer crash in dispatchEvent(null);
* fast/events/dispatchEvent-crash-expected.txt: Added.
* fast/events/dispatchEvent-crash.html: Added.
2008-11-29 Dan Bernstein <mitz@apple.com>
Reviewed by Alexey Proskuryakov.
......
This is a test for https://bugs.webkit.org/show_bug.cgi?id=21063 (NULL pointer crash in dispatchEvent(null)). It passes if it does not crash.
<p>This is a test for https://bugs.webkit.org/show_bug.cgi?id=21063 (NULL pointer crash in dispatchEvent(null)). It passes if it does not crash.</p>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
// FIXME: this should also test WorkerContext and MessagePort.
var eventTargets = [new XMLHttpRequest, (new XMLHttpRequest).upload, window.applicationCache, new Worker("about:blank"), document.body];
for (var i = 0; i < eventTargets.length; ++i) {
eventTarget = eventTargets[i];
try {
eventTarget.dispatchEvent(null);
} catch(e) {
}
try {
eventTarget.dispatchEvent(undefined);
} catch(e) {
}
try {
eventTarget.dispatchEvent("string");
} catch(e) {
}
try {
eventTarget.dispatchEvent(0);
} catch(e) {
}
try {
eventTarget.dispatchEvent({});
} catch(e) {
}
}
</script>
2008-11-28 Sam Weinig <sam@webkit.org>
Reviewed by Alexey Proskuryakov.
Fix for https://bugs.webkit.org/show_bug.cgi?id=21063
NULL pointer crash in dispatchEvent(null);
Test: fast/events/dispatchEvent-crash.html
* dom/MessagePort.cpp:
(WebCore::MessagePort::dispatchEvent):
* dom/Worker.cpp:
(WebCore::Worker::dispatchEvent):
* dom/WorkerContext.cpp:
(WebCore::WorkerContext::dispatchEvent):
* loader/appcache/DOMApplicationCache.cpp:
(WebCore::DOMApplicationCache::dispatchEvent):
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::dispatchEvent):
* xml/XMLHttpRequestUpload.cpp:
(WebCore::XMLHttpRequestUpload::dispatchEvent):
2008-11-29 Dan Bernstein <mitz@apple.com>
Reviewed by Alexey Proskuryakov.
......@@ -321,7 +321,7 @@ void MessagePort::removeEventListener(const AtomicString& eventType, EventListen
bool MessagePort::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
{
if (event->type().isEmpty()) {
if (!event || event->type().isEmpty()) {
ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
return true;
}
......
......@@ -169,7 +169,7 @@ void Worker::removeEventListener(const AtomicString& eventType, EventListener* e
bool Worker::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
{
if (event->type().isEmpty()) {
if (!event || event->type().isEmpty()) {
ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
return true;
}
......
......@@ -135,7 +135,7 @@ void WorkerContext::removeEventListener(const AtomicString& eventType, EventList
bool WorkerContext::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
{
if (event->type().isEmpty()) {
if (!event || event->type().isEmpty()) {
ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
return true;
}
......
......@@ -215,7 +215,7 @@ void DOMApplicationCache::removeEventListener(const AtomicString& eventType, Eve
bool DOMApplicationCache::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
{
if (event->type().isEmpty()) {
if (!event || event->type().isEmpty()) {
ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
return true;
}
......
......@@ -428,7 +428,7 @@ void XMLHttpRequest::removeEventListener(const AtomicString& eventType, EventLis
bool XMLHttpRequest::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
{
// FIXME: check for other error conditions enumerated in the spec.
if (evt->type().isEmpty()) {
if (!evt || evt->type().isEmpty()) {
ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
return true;
}
......
......@@ -87,7 +87,7 @@ void XMLHttpRequestUpload::removeEventListener(const AtomicString& eventType, Ev
bool XMLHttpRequestUpload::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
{
// FIXME: check for other error conditions enumerated in the spec.
if (evt->type().isEmpty()) {
if (!evt || evt->type().isEmpty()) {
ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
return true;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment