Clear failed image loads when an <img> is adopted into a different document

https://bugs.webkit.org/show_bug.cgi?id=104409 Reviewed by Nate Chapin. Source/WebCore: This avoids an assertion failure setImageWithoutConsideringPendingLoadEvent(). Test: loader/image-loader-adoptNode-assert.html * loader/ImageLoader.cpp: (WebCore::ImageLoader::updateFromElement): Use new helper. (WebCore::ImageLoader::updateFromElementIgnoringPreviousError): ditto (WebCore::ImageLoader::elementDidMoveToNewDocument): ditto (WebCore::ImageLoader::clearFailedLoadURL): Added a helper method to self-document the code. (WebCore): * loader/ImageLoader.h: (ImageLoader): LayoutTests: * loader/image-loader-adoptNode-assert-expected.txt: Added. * loader/image-loader-adoptNode-assert.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138724 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Clear failed image loads when an <img> is adopted into a different document
https://bugs.webkit.org/show_bug.cgi?id=104409 Reviewed by Nate Chapin. Source/WebCore: This avoids an assertion failure setImageWithoutConsideringPendingLoadEvent(). Test: loader/image-loader-adoptNode-assert.html * loader/ImageLoader.cpp: (WebCore::ImageLoader::updateFromElement): Use new helper. (WebCore::ImageLoader::updateFromElementIgnoringPreviousError): ditto (WebCore::ImageLoader::elementDidMoveToNewDocument): ditto (WebCore::ImageLoader::clearFailedLoadURL): Added a helper method to self-document the code. (WebCore): * loader/ImageLoader.h: (ImageLoader): LayoutTests: * loader/image-loader-adoptNode-assert-expected.txt: Added. * loader/image-loader-adoptNode-assert.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138724 268f45cc-cd09-0410-ab3c-d52691b4dbfc
859a0f1b · adamk@chromium.org · d7a55816 · 859a0f1b · 859a0f1b · 859a0f1b
Commit 859a0f1b authored Jan 03, 2013 by adamk@chromium.org
6 changed files
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
+2013-01-03  Adam Klein  <adamk@chromium.org>
+
+        Clear failed image loads when an <img> is adopted into a different document
+        https://bugs.webkit.org/show_bug.cgi?id=104409
+
+        Reviewed by Nate Chapin.
+
+        * loader/image-loader-adoptNode-assert-expected.txt: Added.
+        * loader/image-loader-adoptNode-assert.html: Added.
+
 2013-01-03  Vincent Scheib  <scheib@chromium.org>

        Sandbox-blocked pointer lock should log to the console.
--- a/LayoutTests/loader/image-loader-adoptNode-assert-expected.txt
+++ b/LayoutTests/loader/image-loader-adoptNode-assert-expected.txt
+Blocked access to external URL http://foo.com/blarg.jpg
+Test passes if it does not ASSERT
--- a/LayoutTests/loader/image-loader-adoptNode-assert.html
+++ b/LayoutTests/loader/image-loader-adoptNode-assert.html
+<!DOCTYPE html>
+<script>
+if (window.testRunner) testRunner.dumpAsText();
+var doc = document.implementation.createHTMLDocument('');
+var img = document.createElement('img');
+img.onerror = function() { doc.adoptNode(img); };
+img.src = 'http://foo.com/blarg.jpg';
+</script>
+<div>Test passes if it does not ASSERT</div>
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
+2013-01-03  Adam Klein  <adamk@chromium.org>
+
+        Clear failed image loads when an <img> is adopted into a different document
+        https://bugs.webkit.org/show_bug.cgi?id=104409
+
+        Reviewed by Nate Chapin.
+
+        This avoids an assertion failure setImageWithoutConsideringPendingLoadEvent().
+
+        Test: loader/image-loader-adoptNode-assert.html
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateFromElement): Use new helper.
+        (WebCore::ImageLoader::updateFromElementIgnoringPreviousError): ditto
+        (WebCore::ImageLoader::elementDidMoveToNewDocument): ditto
+        (WebCore::ImageLoader::clearFailedLoadURL): Added a helper method to self-document the code.
+        (WebCore):
+        * loader/ImageLoader.h:
+        (ImageLoader):
+
 2013-01-03  Vincent Scheib  <scheib@chromium.org>

        Sandbox-blocked pointer lock should log to the console.
--- a/Source/WebCore/loader/ImageLoader.cpp
+++ b/Source/WebCore/loader/ImageLoader.cpp
@@ -214,7 +214,7 @@ void ImageLoader::updateFromElement()
            m_hasPendingErrorEvent = true;
            errorEventSender().dispatchEventSoon(this);
        } else
-            m_failedLoadURL = AtomicString();
+            clearFailedLoadURL();
    } else if (!attr.isNull()) {
        // Fire an error event if the url is empty.
        // FIXME: Should we fire this event asynchronoulsy via errorEventSender()?
@@ -263,8 +263,7 @@ void ImageLoader::updateFromElement()

 void ImageLoader::updateFromElementIgnoringPreviousError()
 {
-    // Clear previous error.
-    m_failedLoadURL = AtomicString();
+    clearFailedLoadURL();
    updateFromElement();
 }

@@ -452,7 +451,13 @@ void ImageLoader::dispatchPendingErrorEvents()

 void ImageLoader::elementDidMoveToNewDocument()
 {
+    clearFailedLoadURL();
    setImage(0);
 }

+inline void ImageLoader::clearFailedLoadURL()
+{
+    m_failedLoadURL = AtomicString();
+}
+
 }
--- a/Source/WebCore/loader/ImageLoader.h
+++ b/Source/WebCore/loader/ImageLoader.h
@@ -92,6 +92,7 @@ private:
    void updateRenderer();

    void setImageWithoutConsideringPendingLoadEvent(CachedImage*);
+    void clearFailedLoadURL();

    ImageLoaderClient* m_client;
    CachedResourceHandle<CachedImage> m_image;