Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(5)

Side by Side Diff: third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp

Issue 2173873003: Cancel image loads if decoding failed (attempt #2) (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix UAF Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2006 Eric Seidel <eric@webkit.org> 2 * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
3 * Copyright (C) 2008, 2009 Apple Inc. All rights reserved. 3 * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
4 * Copyright (C) Research In Motion Limited 2011. All rights reserved. 4 * Copyright (C) Research In Motion Limited 2011. All rights reserved.
5 * 5 *
6 * Redistribution and use in source and binary forms, with or without 6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions 7 * modification, are permitted provided that the following conditions
8 * are met: 8 * are met:
9 * 1. Redistributions of source code must retain the above copyright 9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer. 10 * notice, this list of conditions and the following disclaimer.
(...skipping 461 matching lines...) Expand 10 before | Expand all | Expand 10 after
472 } 472 }
473 473
474 void SVGImage::updateUseCounters(Document& document) const 474 void SVGImage::updateUseCounters(Document& document) const
475 { 475 {
476 if (SVGSVGElement* rootElement = svgRootElement(m_page.get())) { 476 if (SVGSVGElement* rootElement = svgRootElement(m_page.get())) {
477 if (rootElement->timeContainer()->hasAnimations()) 477 if (rootElement->timeContainer()->hasAnimations())
478 Deprecation::countDeprecation(document, UseCounter::SVGSMILAnimation InImageRegardlessOfCache); 478 Deprecation::countDeprecation(document, UseCounter::SVGSMILAnimation InImageRegardlessOfCache);
479 } 479 }
480 } 480 }
481 481
482 bool SVGImage::dataChanged(bool allDataReceived) 482 Image::SizeAvailability SVGImage::dataChanged(bool allDataReceived)
483 { 483 {
484 TRACE_EVENT0("blink", "SVGImage::dataChanged"); 484 TRACE_EVENT0("blink", "SVGImage::dataChanged");
485 485
486 // Don't do anything if is an empty image. 486 // Don't do anything if is an empty image.
487 if (!data()->size()) 487 if (!data()->size())
488 return true; 488 return SizeAvailable;
489 489
490 if (allDataReceived) { 490 if (allDataReceived) {
491 // SVGImage will fire events (and the default C++ handlers run) but does n't 491 // SVGImage will fire events (and the default C++ handlers run) but does n't
492 // actually allow script to run so it's fine to call into it. We allow t his 492 // actually allow script to run so it's fine to call into it. We allow t his
493 // since it means an SVG data url can synchronously load like other imag e 493 // since it means an SVG data url can synchronously load like other imag e
494 // types. 494 // types.
495 EventDispatchForbiddenScope::AllowUserAgentEvents allowUserAgentEvents; 495 EventDispatchForbiddenScope::AllowUserAgentEvents allowUserAgentEvents;
496 496
497 DEFINE_STATIC_LOCAL(FrameLoaderClient, dummyFrameLoaderClient, (EmptyFra meLoaderClient::create())); 497 DEFINE_STATIC_LOCAL(FrameLoaderClient, dummyFrameLoaderClient, (EmptyFra meLoaderClient::create()));
498 498
499 if (m_page) { 499 if (m_page) {
500 toLocalFrame(m_page->mainFrame())->loader().load(FrameLoadRequest(0, blankURL(), SubstituteData(data(), AtomicString("image/svg+xml"), 500 toLocalFrame(m_page->mainFrame())->loader().load(FrameLoadRequest(0, blankURL(), SubstituteData(data(), AtomicString("image/svg+xml"),
501 AtomicString("UTF-8"), KURL(), ForceSynchronousLoad))); 501 AtomicString("UTF-8"), KURL(), ForceSynchronousLoad)));
502 return true; 502 return SizeAvailable;
503 } 503 }
504 504
505 Page::PageClients pageClients; 505 Page::PageClients pageClients;
506 fillWithEmptyClients(pageClients); 506 fillWithEmptyClients(pageClients);
507 m_chromeClient = SVGImageChromeClient::create(this); 507 m_chromeClient = SVGImageChromeClient::create(this);
508 pageClients.chromeClient = m_chromeClient.get(); 508 pageClients.chromeClient = m_chromeClient.get();
509 509
510 // FIXME: If this SVG ends up loading itself, we might leak the world. 510 // FIXME: If this SVG ends up loading itself, we might leak the world.
511 // The Cache code does not know about ImageResources holding Frames and 511 // The Cache code does not know about ImageResources holding Frames and
512 // won't know to break the cycle. 512 // won't know to break the cycle.
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after
552 m_page = page; 552 m_page = page;
553 553
554 TRACE_EVENT0("blink", "SVGImage::dataChanged::load"); 554 TRACE_EVENT0("blink", "SVGImage::dataChanged::load");
555 loader.load(FrameLoadRequest(0, blankURL(), SubstituteData(data(), Atomi cString("image/svg+xml"), 555 loader.load(FrameLoadRequest(0, blankURL(), SubstituteData(data(), Atomi cString("image/svg+xml"),
556 AtomicString("UTF-8"), KURL(), ForceSynchronousLoad))); 556 AtomicString("UTF-8"), KURL(), ForceSynchronousLoad)));
557 557
558 // Set the concrete object size before a container size is available. 558 // Set the concrete object size before a container size is available.
559 m_intrinsicSize = roundedIntSize(concreteObjectSize(FloatSize(LayoutRepl aced::defaultWidth, LayoutReplaced::defaultHeight))); 559 m_intrinsicSize = roundedIntSize(concreteObjectSize(FloatSize(LayoutRepl aced::defaultWidth, LayoutReplaced::defaultHeight)));
560 } 560 }
561 561
562 return m_page; 562 return m_page ? SizeAvailable : SizeUnavailable;
563 } 563 }
564 564
565 String SVGImage::filenameExtension() const 565 String SVGImage::filenameExtension() const
566 { 566 {
567 return "svg"; 567 return "svg";
568 } 568 }
569 569
570 } // namespace blink 570 } // namespace blink
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698