Title: [229933] trunk
Revision
229933
Author
dba...@webkit.org
Date
2018-03-23 16:37:13 -0700 (Fri, 23 Mar 2018)

Log Message

Unreviewed, rolling out r229868.

Caused media controls tests to timeout. Will investigate
offline.

Reverted changeset:

"CSS mask images should be retrieved using potentially CORS-
enabled fetch"
https://bugs.webkit.org/show_bug.cgi?id=179983
https://trac.webkit.org/changeset/229868

Modified Paths

Removed Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (229932 => 229933)


--- trunk/LayoutTests/ChangeLog	2018-03-23 23:35:03 UTC (rev 229932)
+++ trunk/LayoutTests/ChangeLog	2018-03-23 23:37:13 UTC (rev 229933)
@@ -1,3 +1,17 @@
+2018-03-23  Daniel Bates  <daba...@apple.com>
+
+        Unreviewed, rolling out r229868.
+
+        Caused media controls tests to timeout. Will investigate
+        offline.
+
+        Reverted changeset:
+
+        "CSS mask images should be retrieved using potentially CORS-
+        enabled fetch"
+        https://bugs.webkit.org/show_bug.cgi?id=179983
+        https://trac.webkit.org/changeset/229868
+
 2018-03-23  Per Arne Vollan  <pvol...@apple.com>
 
         Mark accessibility/row-with-aria-role-in-native-table.html as failing on Windows.

Deleted: trunk/LayoutTests/http/tests/security/css-mask-image-expected.html (229932 => 229933)


--- trunk/LayoutTests/http/tests/security/css-mask-image-expected.html	2018-03-23 23:35:03 UTC (rev 229932)
+++ trunk/LayoutTests/http/tests/security/css-mask-image-expected.html	2018-03-23 23:37:13 UTC (rev 229933)
@@ -1,18 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.square {
-    width: 128px;
-    height: 128px;
-}
-</style>
-</head>
-<body>
-<p>This tests that a potentially CORS fetch is performed for a CSS mask image. This test PASSED if you see a solid yellow square and solid blue square below (in order). Otherwise, it FAILED.</p>
-<p>Without CORS access:</p>
-<div class="square" style="background-color: yellow"></div>
-<p>With CORS access:</p>
-<div class="square" style="background-color: blue"></div>
-</body>
-</html>

Deleted: trunk/LayoutTests/http/tests/security/css-mask-image.html (229932 => 229933)


--- trunk/LayoutTests/http/tests/security/css-mask-image.html	2018-03-23 23:35:03 UTC (rev 229932)
+++ trunk/LayoutTests/http/tests/security/css-mask-image.html	2018-03-23 23:37:13 UTC (rev 229933)
@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.square {
-    width: 128px;
-    height: 128px;
-}
-
-.blue-background {
-    background-color: blue;
-}
-
-.mask-cors-no-access {
-    mask-image: url("http://localhost:8000/security/resources/image-access-control.php?file=fail-mask.png");
-    mask-size: 128px 128px;
-    -webkit-mask-image: url("http://localhost:8000/security/resources/image-access-control.php?file=fail-mask.png");
-    -webkit-mask-size: 128px 128px;
-}
-
-.mask-cors-has-access {
-    mask-image: url("http://localhost:8000/security/resources/image-access-control.php?allow=true&file=black-square.png");
-    mask-size: 128px 128px;
-    -webkit-mask-image: url("http://localhost:8000/security/resources/image-access-control.php?allow=true&file=black-square.png");
-    -webkit-mask-size: 128px 128px;
-}
-</style>
-</head>
-<body>
-<p>This tests that a potentially CORS fetch is performed for a CSS mask image. This test PASSED if you see a solid yellow square and solid blue square below (in order). Otherwise, it FAILED.</p>
-<p>Without CORS access:</p>
-<div class="square" style="background-color: yellow"><div class="square blue-background mask-cors-no-access"></div></div>
-<p>With CORS access:</p>
-<div class="square blue-background mask-cors-has-access"></div>
-</body>
-</html>

Deleted: trunk/LayoutTests/http/tests/security/resources/black-square.png


(Binary files differ)

Deleted: trunk/LayoutTests/http/tests/security/resources/fail-mask.png


(Binary files differ)

Modified: trunk/Source/WebCore/ChangeLog (229932 => 229933)


--- trunk/Source/WebCore/ChangeLog	2018-03-23 23:35:03 UTC (rev 229932)
+++ trunk/Source/WebCore/ChangeLog	2018-03-23 23:37:13 UTC (rev 229933)
@@ -1,3 +1,17 @@
+2018-03-23  Daniel Bates  <daba...@apple.com>
+
+        Unreviewed, rolling out r229868.
+
+        Caused media controls tests to timeout. Will investigate
+        offline.
+
+        Reverted changeset:
+
+        "CSS mask images should be retrieved using potentially CORS-
+        enabled fetch"
+        https://bugs.webkit.org/show_bug.cgi?id=179983
+        https://trac.webkit.org/changeset/229868
+
 2018-03-23  Mark Lam  <mark....@apple.com>
 
         Add pointer profiling hooks to the CSS JIT.

Modified: trunk/Source/WebCore/style/StylePendingResources.cpp (229932 => 229933)


--- trunk/Source/WebCore/style/StylePendingResources.cpp	2018-03-23 23:35:03 UTC (rev 229932)
+++ trunk/Source/WebCore/style/StylePendingResources.cpp	2018-03-23 23:37:13 UTC (rev 229933)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,9 +41,8 @@
 namespace WebCore {
 namespace Style {
 
-// <https://html.spec.whatwg.org/multipage/urls-and-fetching.html#cors-settings-attributes> (21 March 2018)
-enum class LoadPolicy { NoCORS, Anonymous };
-static void loadPendingImage(Document& document, const StyleImage* styleImage, const Element* element, LoadPolicy loadPolicy = LoadPolicy::NoCORS)
+enum class LoadPolicy { Normal, ShapeOutside };
+static void loadPendingImage(Document& document, const StyleImage* styleImage, const Element* element, LoadPolicy loadPolicy = LoadPolicy::Normal)
 {
     if (!styleImage || !styleImage->isPending())
         return;
@@ -51,7 +50,8 @@
     ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
     options.contentSecurityPolicyImposition = element && element->isInUserAgentShadowTree() ? ContentSecurityPolicyImposition::SkipPolicyCheck : ContentSecurityPolicyImposition::DoPolicyCheck;
 
-    if (loadPolicy == LoadPolicy::Anonymous) {
+    // FIXME: Why does shape-outside have different policy than other properties?
+    if (loadPolicy == LoadPolicy::ShapeOutside) {
         options.mode = FetchOptions::Mode::Cors;
         options.credentials = FetchOptions::Credentials::SameOrigin;
         options.storedCredentialsPolicy = StoredCredentialsPolicy::DoNotUse;
@@ -85,14 +85,11 @@
     if (auto* reflection = style.boxReflect())
         loadPendingImage(document, reflection->mask().image(), element);
 
-    // Masking operations may be sensitive to timing attacks that can be used to reveal the pixel data of
-    // the image used as the mask. As a means to mitigate such attacks CSS mask images and shape-outside
-    // images are retreived in "Anonymous" mode, which uses a potentially CORS-enabled fetch.
     for (auto* maskLayer = &style.maskLayers(); maskLayer; maskLayer = maskLayer->next())
-        loadPendingImage(document, maskLayer->image(), element, LoadPolicy::Anonymous);
+        loadPendingImage(document, maskLayer->image(), element);
 
     if (style.shapeOutside())
-        loadPendingImage(document, style.shapeOutside()->image(), element, LoadPolicy::Anonymous);
+        loadPendingImage(document, style.shapeOutside()->image(), element, LoadPolicy::ShapeOutside);
 }
 
 }
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to