Attachment #143151 for bug #86991

View Details Raw Unified Return to Bug 86991

| Differences between



2012-05-20  Kentaro Hara  <haraken@chromium.org>

        REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"
        https://bugs.webkit.org/show_bug.cgi?id=86991

        Reviewed by Ojan Vafai.

        Original Chromium bug: http://code.google.com/p/chromium/issues/detail?id=128723

        Consider the following html:

        <html><body><form>
        <input type="hidden" name="arguments"></input>
        <div onclick="onclicked()" id="divInsideForm">Click here</div>
        </form></body>
        <script>
        function onclicked() {
          alert("onclicked");
        }
        </script>
        </html>

        If we click "Click here", JavaScript throws "Uncaught TypeError: undefined has no properties".

        This is a regression caused by r110315. V8LazyEventListener should not use
        'arguments' to retrieve the execution contexts, since 'arguments' can be
        being overwritten by JavaScript.

        This patch changes V8LazyEventListener so that it retrieves contexts
        by this.ownerDocument, this.form, and this.

        Test: fast/forms/form-input-named-arguments.html

        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::prepareListenerObject):

2012-05-21  Emil A Eklund  <eae@chromium.org>

        Move padding/margin/offset writing mode logic from RenderStyle to LengthBox



    // FIXME: V8 does not allow us to programmatically create object environments so
    //        we have to do this hack! What if m_code escapes to run arbitrary script?
    //
    // Call with 4 arguments instead of 3, pass additional null as last parameter.
    // By calling the function with 4 arguments, we create a setter on arguments object
    // which would shadow property "3" on the prototype.
    String code = "(function() {" \
        "arguments[3] = function() {" \
        "with (this[2]) {" \
        "with (this[1]) {" \
        "with (this[0]) {";
    code.append("return function(");
    code.append(m_eventParameterName);
    code.append(") {");
    code.append(m_code);
    // Insert '\n' otherwise //-style comments could break the handler.
    code.append("\n};}}}}; return arguments[3]();})");
    v8::Handle<v8::String> codeExternalString = v8ExternalString(code);

    v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);



2012-05-20  Kentaro Hara  <haraken@chromium.org>

        REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"
        https://bugs.webkit.org/show_bug.cgi?id=86991

        Reviewed by Ojan Vafai.

        The added test checks whether an event handler is successfully invoked
        for an input element with name="arguments".

        * fast/forms/form-input-named-arguments-expected.txt: Added.
        * fast/forms/form-input-named-arguments.html: Added.

2012-05-21  Levi Weintraub  <leviw@chromium.org>

        Unreviewed. More rebaselines following r117815.

Line 0 a/LayoutTests/fast/forms/form-input-named-arguments-expected.txt_sec1
- a/LayoutTests/fast/forms/form-input-named-arguments-expected.txt +5 lines
	1	onclicked() is successfully called.
	2	PASS successfullyParsed is true
	3
	4	TEST COMPLETE
	5



<!DOCTYPE html>
<html>
<head></head>
<body>
<script src="../js/resources/js-test-pre.js"></script>
<form>
<input type="hidden" name="arguments"></input>
<div onclick="onclicked()" id="divInsideForm"></div>
</form>
</body>
<script>
if (window.layoutTestController)
  layoutTestController.waitUntilDone();

function onclicked() {
   debug("onclicked() is successfully called.");
   if (window.layoutTestController) {
     successfullyParsed = true;
     layoutTestController.notifyDone();
   }
}

var event = document.createEvent("MouseEvents");
event.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
var div = document.getElementById("divInsideForm");
div.dispatchEvent(event);
</script>
<script src="../js/resources/js-test-post.js"></script>
</html>

Return to Bug 86991

Lines 137-152 void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context) a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp_sec1
- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp -4 / +8 lines
137	// FIXME: V8 does not allow us to programmatically create object environments so	137	// FIXME: V8 does not allow us to programmatically create object environments so
138	// we have to do this hack! What if m_code escapes to run arbitrary script?	138	// we have to do this hack! What if m_code escapes to run arbitrary script?
139	//	139	//
		140	// Call with 4 arguments instead of 3, pass additional null as last parameter.
		141	// By calling the function with 4 arguments, we create a setter on arguments object
		142	// which would shadow property "3" on the prototype.
140	String code = "(function() {" \	143	String code = "(function() {" \
141	"with (arguments[2]) {" \	144	"arguments[3] = function() {" \
142	"with (arguments[1]) {" \	145	"with (this[2]) {" \
143	"with (arguments[0]) {";	146	"with (this[1]) {" \
		147	"with (this[0]) {";
144	code.append("return function(");	148	code.append("return function(");
145	code.append(m_eventParameterName);	149	code.append(m_eventParameterName);
146	code.append(") {");	150	code.append(") {");
147	code.append(m_code);	151	code.append(m_code);
148	// Insert '\n' otherwise //-style comments could break the handler.	152	// Insert '\n' otherwise //-style comments could break the handler.
149	code.append("\n};}}}})");	153	code.append("\n};}}}}; return arguments[3]();})");
150	v8::Handle<v8::String> codeExternalString = v8ExternalString(code);	154	v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
151		155
152	v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);	156	v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +36 lines
		1	2012-05-20 Kentaro Hara <haraken@chromium.org>
		2
		3	REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"
		4	https://bugs.webkit.org/show_bug.cgi?id=86991
		5
		6	Reviewed by Ojan Vafai.
		7
		8	Original Chromium bug: http://code.google.com/p/chromium/issues/detail?id=128723
		9
		10	Consider the following html:
		11
		12	<html><body><form>
		13	<input type="hidden" name="arguments"></input>
		14	<div onclick="onclicked()" id="divInsideForm">Click here</div>
		15	</form></body>
		16	<script>
		17	function onclicked() {
		18	alert("onclicked");
		19	}
		20	</script>
		21	</html>
		22
		23	If we click "Click here", JavaScript throws "Uncaught TypeError: undefined has no properties".
		24
		25	This is a regression caused by r110315. V8LazyEventListener should not use
		26	'arguments' to retrieve the execution contexts, since 'arguments' can be
		27	being overwritten by JavaScript.
		28
		29	This patch changes V8LazyEventListener so that it retrieves contexts
		30	by this.ownerDocument, this.form, and this.
		31
		32	Test: fast/forms/form-input-named-arguments.html
		33
		34	* bindings/v8/V8LazyEventListener.cpp:
		35	(WebCore::V8LazyEventListener::prepareListenerObject):
		36
1	2012-05-21 Emil A Eklund <eae@chromium.org>	37	2012-05-21 Emil A Eklund <eae@chromium.org>
2		38
3	Move padding/margin/offset writing mode logic from RenderStyle to LengthBox	39	Move padding/margin/offset writing mode logic from RenderStyle to LengthBox

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +13 lines
		1	2012-05-20 Kentaro Hara <haraken@chromium.org>
		2
		3	REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"
		4	https://bugs.webkit.org/show_bug.cgi?id=86991
		5
		6	Reviewed by Ojan Vafai.
		7
		8	The added test checks whether an event handler is successfully invoked
		9	for an input element with name="arguments".
		10
		11	* fast/forms/form-input-named-arguments-expected.txt: Added.
		12	* fast/forms/form-input-named-arguments.html: Added.
		13
1	2012-05-21 Levi Weintraub <leviw@chromium.org>	14	2012-05-21 Levi Weintraub <leviw@chromium.org>
2		15
3	Unreviewed. More rebaselines following r117815.	16	Unreviewed. More rebaselines following r117815.

Line 0 a/LayoutTests/fast/forms/form-input-named-arguments.html_sec1
- a/LayoutTests/fast/forms/form-input-named-arguments.html +29 lines
	1	<!DOCTYPE html>
	2	<html>
	3	<head></head>
	4	<body>
	5	<script src="../js/resources/js-test-pre.js"></script>
	6	<form>
	7	<input type="hidden" name="arguments"></input>
	8	<div onclick="onclicked()" id="divInsideForm"></div>
	9	</form>
	10	</body>
	11	<script>
	12	if (window.layoutTestController)
	13	layoutTestController.waitUntilDone();
	14
	15	function onclicked() {
	16	debug("onclicked() is successfully called.");
	17	if (window.layoutTestController) {
	18	successfullyParsed = true;
	19	layoutTestController.notifyDone();
	20	}
	21	}
	22
	23	var event = document.createEvent("MouseEvents");
	24	event.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
	25	var div = document.getElementById("divInsideForm");
	26	div.dispatchEvent(event);
	27	</script>
	28	<script src="../js/resources/js-test-post.js"></script>
	29	</html>