Title: [124027] trunk
Revision
124027
Author
shin...@chromium.org
Date
2012-07-30 08:16:24 -0700 (Mon, 30 Jul 2012)

Log Message

Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
https://bugs.webkit.org/show_bug.cgi?id=92611

Reviewed by Hajime Morita.

.:

* Source/autotools/symbols.filter:

Source/WebCore:

Prohibit having AuthorShadowDOM of input elemnet unless a flag in RuntimeEnabledFeatures is not enabled.
The flag can be enabled in Internals.

The elements in UserAgentShadowDOM of input element assume that they have a renderer when the input
element has a renderer. However, this does not hold when AuthorShadowDOM is added to input element.
So until we fix the issue, we should disable to have AuthorShadowDOM for input element, because it may
cause crashes and security problems.

Tests: fast/dom/shadow/input-with-validation-without-shadow.html
       fast/dom/shadow/input-with-validation.html
       fast/dom/shadow/shadow-disable.html

* bindings/generic/RuntimeEnabledFeatures.cpp:
(WebCore):
* bindings/generic/RuntimeEnabledFeatures.h:
(RuntimeEnabledFeatures):
(WebCore::RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled):
(WebCore::RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled):
* dom/ShadowRoot.cpp:
(WebCore::allowsAuthorShadowRoot): The input element or textarea element does not allow to have a ShadowDOM unless
is a flag in RuntimeEnabledFeatures is not enabled.
* html/HTMLInputElement.h:
(WebCore::isHTMLInputElement):
(WebCore):
* html/HTMLTextAreaElement.h:
(WebCore::isHTMLTextAreaElement):
(WebCore):
* testing/Internals.cpp:
(WebCore::Internals::setAuthorShadowDOMForAnyElementEnabled):
(WebCore):
* testing/Internals.h:
(Internals):
* testing/Internals.idl:

LayoutTests:

* fast/dom/shadow/input-with-validation-without-shadow.html: Make the test runs even if
new WebKitShadowRoot() throws an exception.
* fast/dom/shadow/input-with-validation.html: Sets a flag to make AuthorShadowDOM available.
* fast/dom/shadow/shadow-disable-expected.txt:
* fast/dom/shadow/shadow-disable.html: Makes it unavailable for input and textarea to have an AuthorShadowDOM.

Modified Paths

Diff

Modified: trunk/ChangeLog (124026 => 124027)


--- trunk/ChangeLog	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/ChangeLog	2012-07-30 15:16:24 UTC (rev 124027)
@@ -1,3 +1,12 @@
+2012-07-30  Shinya Kawanaka  <shin...@chromium.org>
+
+        Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
+        https://bugs.webkit.org/show_bug.cgi?id=92611
+
+        Reviewed by Hajime Morita.
+
+        * Source/autotools/symbols.filter:
+
 2012-07-30  Sheriff Bot  <webkit.review....@gmail.com>
 
         Unreviewed, rolling out r124000.

Modified: trunk/LayoutTests/ChangeLog (124026 => 124027)


--- trunk/LayoutTests/ChangeLog	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/ChangeLog	2012-07-30 15:16:24 UTC (rev 124027)
@@ -1,3 +1,16 @@
+2012-07-30  Shinya Kawanaka  <shin...@chromium.org>
+
+        Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
+        https://bugs.webkit.org/show_bug.cgi?id=92611
+
+        Reviewed by Hajime Morita.
+
+        * fast/dom/shadow/input-with-validation-without-shadow.html: Make the test runs even if
+        new WebKitShadowRoot() throws an exception.
+        * fast/dom/shadow/input-with-validation.html: Sets a flag to make AuthorShadowDOM available.
+        * fast/dom/shadow/shadow-disable-expected.txt:
+        * fast/dom/shadow/shadow-disable.html: Makes it unavailable for input and textarea to have an AuthorShadowDOM.
+
 2012-07-30  Keishi Hattori  <kei...@webkit.org>
 
         Implement datalist UI for input type color for Chromium

Modified: trunk/LayoutTests/fast/dom/shadow/input-with-validation-without-shadow.html (124026 => 124027)


--- trunk/LayoutTests/fast/dom/shadow/input-with-validation-without-shadow.html	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/fast/dom/shadow/input-with-validation-without-shadow.html	2012-07-30 15:16:24 UTC (rev 124027)
@@ -8,15 +8,24 @@
 </form>
 
 <script>
-var input = document.getElementById('password');
-var shadowRoot = new WebKitShadowRoot(input);
+function doTest() {
+    var input = document.getElementById('password');
+    var shadowRoot = new WebKitShadowRoot(input);
 
-document.getElementById('submit').click();
-if (window.testRunner) {
-    testRunner.waitUntilDone();
-    setTimeout(function() {
+    document.getElementById('submit').click();
+    if (window.testRunner) {
+        testRunner.waitUntilDone();
+        setTimeout(function() {
+            testRunner.notifyDone();
+        }, 10);
+    }
+}
+
+try {
+    doTest()
+} catch (e) {
+    if (window.testRunner)
         testRunner.notifyDone();
-    }, 10);
 }
 </script>
 

Modified: trunk/LayoutTests/fast/dom/shadow/input-with-validation.html (124026 => 124027)


--- trunk/LayoutTests/fast/dom/shadow/input-with-validation.html	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/fast/dom/shadow/input-with-validation.html	2012-07-30 15:16:24 UTC (rev 124027)
@@ -8,6 +8,9 @@
 </form>
 
 <script>
+if (window.internals)
+    internals.setAuthorShadowDOMForAnyElementEnabled(true);
+
 var input = document.getElementById('password');
 var shadowRoot = new WebKitShadowRoot(input);
 shadowRoot.innerHTML = "<shadow></shadow>";
@@ -16,6 +19,8 @@
 if (window.testRunner) {
     testRunner.waitUntilDone();
     setTimeout(function() {
+        if (window.internals)
+            internals.setAuthorShadowDOMForAnyElementEnabled(false);  
         testRunner.notifyDone();
     }, 10);
 }

Modified: trunk/LayoutTests/fast/dom/shadow/shadow-disable-expected.txt (124026 => 124027)


--- trunk/LayoutTests/fast/dom/shadow/shadow-disable-expected.txt	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-disable-expected.txt	2012-07-30 15:16:24 UTC (rev 124027)
@@ -15,12 +15,12 @@
 PASS new WebKitShadowRoot(element) is not null
 VIDEO
 PASS new WebKitShadowRoot(element) is not null
+SELECT
+PASS new WebKitShadowRoot(element) is not null
 INPUT
-PASS new WebKitShadowRoot(element) is not null
+PASS new WebKitShadowRoot(element) threw exception Error: HIERARCHY_REQUEST_ERR: DOM Exception 3.
 TEXTAREA
-PASS new WebKitShadowRoot(element) is not null
-SELECT
-PASS new WebKitShadowRoot(element) is not null
+PASS new WebKitShadowRoot(element) threw exception Error: HIERARCHY_REQUEST_ERR: DOM Exception 3.
 tref
 PASS new WebKitShadowRoot(element) threw exception Error: HIERARCHY_REQUEST_ERR: DOM Exception 3.
 PASS successfullyParsed is true

Modified: trunk/LayoutTests/fast/dom/shadow/shadow-disable.html (124026 => 124027)


--- trunk/LayoutTests/fast/dom/shadow/shadow-disable.html	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-disable.html	2012-07-30 15:16:24 UTC (rev 124027)
@@ -26,12 +26,12 @@
     document.createElement('section'),
     document.createElement('audio'),
     document.createElement('video'),
-    document.createElement('input'),
-    document.createElement('textarea'),
     document.createElement('select')
 ];
 
 var elementsToFail = [
+    document.createElement('input'),
+    document.createElement('textarea'),
     document.getElementById('tref')
 ];
 

Modified: trunk/LayoutTests/fast/dom/shadow/shadowdom-for-form-associated-element-useragent-expected.txt (124026 => 124027)


--- trunk/LayoutTests/fast/dom/shadow/shadowdom-for-form-associated-element-useragent-expected.txt	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/fast/dom/shadow/shadowdom-for-form-associated-element-useragent-expected.txt	2012-07-30 15:16:24 UTC (rev 124027)
@@ -8,8 +8,6 @@
 PASS youngerShadowRoot is shadowRoot
 PASS oldestShadowRoot is not shadowRoot
 PASS youngerShadowRoot is shadowRoot
-PASS oldestShadowRoot is not shadowRoot
-PASS youngerShadowRoot is shadowRoot
 PASS successfullyParsed is true
 
 TEST COMPLETE

Modified: trunk/LayoutTests/fast/dom/shadow/shadowdom-for-form-associated-element-useragent.html (124026 => 124027)


--- trunk/LayoutTests/fast/dom/shadow/shadowdom-for-form-associated-element-useragent.html	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/LayoutTests/fast/dom/shadow/shadowdom-for-form-associated-element-useragent.html	2012-07-30 15:16:24 UTC (rev 124027)
@@ -7,7 +7,6 @@
 <p>When a AuthorShadowRoot is added, UserAgentShadowRoot should exists as the oldest Shadow Root.</p>
 <div id='container'>
     <form>
-        <textarea id='textarea'></textarea>
         <button id='button'>72</button>
         <select id='select'><option>hoge</option></select>
         <output id='output'></output>
@@ -22,7 +21,7 @@
 
 <script>
 var elems = [
-    "textarea", "button", "select", "keygen", "fieldset"
+    "button", "select", "keygen", "fieldset"
 ];
 
 var shadowRoot;

Modified: trunk/Source/WebCore/ChangeLog (124026 => 124027)


--- trunk/Source/WebCore/ChangeLog	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/ChangeLog	2012-07-30 15:16:24 UTC (rev 124027)
@@ -1,3 +1,44 @@
+2012-07-30  Shinya Kawanaka  <shin...@chromium.org>
+
+        Prohibit having AuthorShadowDOM of input or textarea element for a while and having a flag to enable it in Internals.
+        https://bugs.webkit.org/show_bug.cgi?id=92611
+
+        Reviewed by Hajime Morita.
+
+        Prohibit having AuthorShadowDOM of input elemnet unless a flag in RuntimeEnabledFeatures is not enabled.
+        The flag can be enabled in Internals.
+
+        The elements in UserAgentShadowDOM of input element assume that they have a renderer when the input
+        element has a renderer. However, this does not hold when AuthorShadowDOM is added to input element.
+        So until we fix the issue, we should disable to have AuthorShadowDOM for input element, because it may
+        cause crashes and security problems.
+
+        Tests: fast/dom/shadow/input-with-validation-without-shadow.html
+               fast/dom/shadow/input-with-validation.html
+               fast/dom/shadow/shadow-disable.html
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled):
+        * dom/ShadowRoot.cpp:
+        (WebCore::allowsAuthorShadowRoot): The input element or textarea element does not allow to have a ShadowDOM unless
+        is a flag in RuntimeEnabledFeatures is not enabled.
+        * html/HTMLInputElement.h:
+        (WebCore::isHTMLInputElement):
+        (WebCore):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::isHTMLTextAreaElement):
+        (WebCore):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setAuthorShadowDOMForAnyElementEnabled):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
 2012-07-30  Pavel Feldman  <pfeld...@chromium.org>
 
         Web Inspector: support --line-numbers mapping for SASS

Modified: trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp (124026 => 124027)


--- trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp	2012-07-30 15:16:24 UTC (rev 124027)
@@ -188,6 +188,8 @@
 
 #if ENABLE(SHADOW_DOM)
 bool RuntimeEnabledFeatures::isShadowDOMEnabled = false;
+
+bool RuntimeEnabledFeatures::isAuthorShadowDOMForAnyElementEnabled = false;
 #endif
 
 #if ENABLE(STYLE_SCOPED)

Modified: trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h (124026 => 124027)


--- trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h	2012-07-30 15:16:24 UTC (rev 124027)
@@ -218,6 +218,9 @@
 #if ENABLE(SHADOW_DOM)
     static bool shadowDOMEnabled() { return isShadowDOMEnabled; }
     static void setShadowDOMEnabled(bool isEnabled) { isShadowDOMEnabled = isEnabled; }
+
+    static bool authorShadowDOMForAnyElementEnabled() { return isAuthorShadowDOMForAnyElementEnabled; }
+    static void setAuthorShadowDOMForAnyElementEnabled(bool isEnabled) { isAuthorShadowDOMForAnyElementEnabled = isEnabled; }
 #endif
 
 #if ENABLE(STYLE_SCOPED)
@@ -324,6 +327,8 @@
 
 #if ENABLE(SHADOW_DOM)
     static bool isShadowDOMEnabled;
+
+    static bool isAuthorShadowDOMForAnyElementEnabled;
 #endif
 
 #if ENABLE(STYLE_SCOPED)

Modified: trunk/Source/WebCore/dom/ShadowRoot.cpp (124026 => 124027)


--- trunk/Source/WebCore/dom/ShadowRoot.cpp	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/dom/ShadowRoot.cpp	2012-07-30 15:16:24 UTC (rev 124027)
@@ -35,9 +35,12 @@
 #include "Element.h"
 #include "ElementShadow.h"
 #include "HTMLContentElement.h"
+#include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HTMLTextAreaElement.h"
 #include "InsertionPoint.h"
 #include "NodeRareData.h"
+#include "RuntimeEnabledFeatures.h"
 #include "SVGNames.h"
 #include "StyleResolver.h"
 #include "markup.h"
@@ -75,6 +78,19 @@
 
 static bool allowsAuthorShadowRoot(Element* element)
 {
+#if ENABLE(SHADOW_DOM)
+    if (RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled())
+        return true;
+#endif
+
+    // FIXME: The elements in Shadow DOM of an input element assumes that they have renderer if the input
+    // element has a renderer. However, this does not hold until input elemnet is AuthorShadowDOM-ready.
+    // So we would like to prohibit having a AuthorShadowDOM for a while. The same thing happens to
+    // textarea element also.
+    // https://bugs.webkit.org/show_bug.cgi?id=92608
+    if (isHTMLInputElement(element) || isHTMLTextAreaElement(element))
+        return false;
+
     // FIXME: We disable multiple shadow subtrees for SVG for while, because there will be problems to support it.
     // https://bugs.webkit.org/show_bug.cgi?id=78205
     // Especially SVG TREF recreates shadow root dynamically.

Modified: trunk/Source/WebCore/html/HTMLInputElement.h (124026 => 124027)


--- trunk/Source/WebCore/html/HTMLInputElement.h	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/html/HTMLInputElement.h	2012-07-30 15:16:24 UTC (rev 124027)
@@ -402,5 +402,11 @@
 #endif
 };
 
+inline bool isHTMLInputElement(Node* node)
+{
+    ASSERT(node);
+    return node->hasTagName(HTMLNames::inputTag);
+}
+
 } //namespace
 #endif

Modified: trunk/Source/WebCore/html/HTMLTextAreaElement.h (124026 => 124027)


--- trunk/Source/WebCore/html/HTMLTextAreaElement.h	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/html/HTMLTextAreaElement.h	2012-07-30 15:16:24 UTC (rev 124027)
@@ -123,6 +123,11 @@
     mutable bool m_wasModifiedByUser;
 };
 
+inline bool isHTMLTextAreaElement(Node* node)
+{
+    return node->hasTagName(HTMLNames::textareaTag);
+}
+
 } //namespace
 
 #endif

Modified: trunk/Source/WebCore/testing/Internals.cpp (124026 => 124027)


--- trunk/Source/WebCore/testing/Internals.cpp	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/testing/Internals.cpp	2012-07-30 15:16:24 UTC (rev 124027)
@@ -60,6 +60,7 @@
 #include "Range.h"
 #include "RenderObject.h"
 #include "RenderTreeAsText.h"
+#include "RuntimeEnabledFeatures.h"
 #include "SchemeRegistry.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
@@ -432,6 +433,15 @@
     return element->setShadowPseudoId(id, ec);
 }
 
+void Internals::setAuthorShadowDOMForAnyElementEnabled(bool isEnabled)
+{
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled(isEnabled);
+#else
+    UNUSED_PARAM(isEnabled);
+#endif
+}
+
 String Internals::visiblePlaceholder(Element* element)
 {
     HTMLTextFormControlElement* textControl = toTextFormControl(element);

Modified: trunk/Source/WebCore/testing/Internals.h (124026 => 124027)


--- trunk/Source/WebCore/testing/Internals.h	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/testing/Internals.h	2012-07-30 15:16:24 UTC (rev 124027)
@@ -82,6 +82,8 @@
     String shadowPseudoId(Element*, ExceptionCode&);
     void setShadowPseudoId(Element*, const String&, ExceptionCode&);
 
+    void setAuthorShadowDOMForAnyElementEnabled(bool isEnabled);
+
     PassRefPtr<Element> createContentElement(Document*, ExceptionCode&);
     Element* getElementByIdInShadowRoot(Node* shadowRoot, const String& id, ExceptionCode&);
     bool isValidContentSelect(Element* insertionPoint, ExceptionCode&);

Modified: trunk/Source/WebCore/testing/Internals.idl (124026 => 124027)


--- trunk/Source/WebCore/testing/Internals.idl	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/WebCore/testing/Internals.idl	2012-07-30 15:16:24 UTC (rev 124027)
@@ -56,6 +56,7 @@
         boolean isValidContentSelect(in Element contentElement) raises(DOMException);
         Node treeScopeRootNode(in Node node) raises (DOMException);
         Node parentTreeScope(in Node node) raises (DOMException);
+        void setAuthorShadowDOMForAnyElementEnabled(in boolean isEnabled);
 
         Node nextSiblingByWalker(in Node node) raises(DOMException);
         Node firstChildByWalker(in Node node) raises(DOMException);

Modified: trunk/Source/autotools/symbols.filter (124026 => 124027)


--- trunk/Source/autotools/symbols.filter	2012-07-30 15:12:23 UTC (rev 124026)
+++ trunk/Source/autotools/symbols.filter	2012-07-30 15:16:24 UTC (rev 124027)
@@ -156,6 +156,7 @@
 _ZN7WebCore22RuntimeEnabledFeatures18isShadowDOMEnabledE;
 _ZN7WebCore22RuntimeEnabledFeatures22isCSSExclusionsEnabledE;
 _ZN7WebCore22RuntimeEnabledFeatures22isDialogElementEnabledE;
+_ZN7WebCore22RuntimeEnabledFeatures37isAuthorShadowDOMForAnyElementEnabledE;
 _ZNK7WebCore8Document13nodesFromRectEiijjjjbb;
 _ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_8NodeListE;
 _ZNK7WebCore6Editor26selectionStartHasMarkerForENS_14DocumentMarker10MarkerTypeEii;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to