|
|
6aec805 |
diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp.cve-2010-0054-image-element-pointer-name-getter qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
|
|
|
6aec805 |
--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp.cve-2010-0054-image-element-pointer-name-getter 2010-02-11 16:55:17.000000000 +0100
|
|
|
6aec805 |
+++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp 2010-02-25 15:50:05.987741463 +0100
|
|
|
6aec805 |
@@ -515,11 +515,13 @@ bool HTMLFormElement::isURLAttribute(Att
|
|
|
6aec805 |
|
|
|
6aec805 |
void HTMLFormElement::registerImgElement(HTMLImageElement* e)
|
|
|
6aec805 |
{
|
|
|
6aec805 |
+ ASSERT(imgElements.find(e) == notFound);
|
|
|
6aec805 |
imgElements.append(e);
|
|
|
6aec805 |
}
|
|
|
6aec805 |
|
|
|
6aec805 |
void HTMLFormElement::removeImgElement(HTMLImageElement* e)
|
|
|
6aec805 |
{
|
|
|
6aec805 |
+ ASSERT(imgElements.find(e) == notFound);
|
|
|
6aec805 |
removeFromVector(imgElements, e);
|
|
|
6aec805 |
}
|
|
|
6aec805 |
|
|
|
6aec805 |
diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp.cve-2010-0054-image-element-pointer-name-getter qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
|
|
|
6aec805 |
--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp.cve-2010-0054-image-element-pointer-name-getter 2010-02-11 16:55:17.000000000 +0100
|
|
|
6aec805 |
+++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp 2010-02-25 15:43:45.016742027 +0100
|
|
|
6aec805 |
@@ -209,6 +209,40 @@ void HTMLImageElement::removedFromDocume
|
|
|
6aec805 |
HTMLElement::removedFromDocument();
|
|
|
6aec805 |
}
|
|
|
6aec805 |
|
|
|
6aec805 |
+void HTMLImageElement::insertedIntoTree(bool deep)
|
|
|
6aec805 |
+{
|
|
|
6aec805 |
+ if (m_form) {
|
|
|
6aec805 |
+ // m_form was set by constructor. In debug builds, check that it's an ancestor indeed.
|
|
|
6aec805 |
+#ifndef NDEBUG
|
|
|
6aec805 |
+ for (Node* ancestor = parentNode(); /* no end condition - there must be a form ancestor */; ancestor = ancestor->parentNode()) {
|
|
|
6aec805 |
+ ASSERT(ancestor);
|
|
|
6aec805 |
+ if (ancestor->hasTagName(formTag)) {
|
|
|
6aec805 |
+ ASSERT(m_form == static_cast<HTMLFormElement*>(ancestor));
|
|
|
6aec805 |
+ break;
|
|
|
6aec805 |
+ }
|
|
|
6aec805 |
+ }
|
|
|
6aec805 |
+#endif
|
|
|
6aec805 |
+ } else {
|
|
|
6aec805 |
+ for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
|
|
|
6aec805 |
+ if (ancestor->hasTagName(formTag)) {
|
|
|
6aec805 |
+ m_form = static_cast<HTMLFormElement*>(ancestor);
|
|
|
6aec805 |
+ m_form->registerImgElement(this);
|
|
|
6aec805 |
+ break;
|
|
|
6aec805 |
+ }
|
|
|
6aec805 |
+ }
|
|
|
6aec805 |
+ }
|
|
|
6aec805 |
+
|
|
|
6aec805 |
+ HTMLElement::insertedIntoTree(deep);
|
|
|
6aec805 |
+}
|
|
|
6aec805 |
+
|
|
|
6aec805 |
+void HTMLImageElement::removedFromTree(bool deep)
|
|
|
6aec805 |
+{
|
|
|
6aec805 |
+ if (m_form)
|
|
|
6aec805 |
+ m_form->removeImgElement(this);
|
|
|
6aec805 |
+ m_form = 0;
|
|
|
6aec805 |
+ HTMLElement::removedFromTree(deep);
|
|
|
6aec805 |
+}
|
|
|
6aec805 |
+
|
|
|
6aec805 |
int HTMLImageElement::width(bool ignorePendingStylesheets) const
|
|
|
6aec805 |
{
|
|
|
6aec805 |
if (!renderer()) {
|
|
|
6aec805 |
diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h.cve-2010-0054-image-element-pointer-name-getter qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
|
|
|
6aec805 |
--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h.cve-2010-0054-image-element-pointer-name-getter 2010-02-11 16:55:17.000000000 +0100
|
|
|
6aec805 |
+++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h 2010-02-25 15:41:18.340929598 +0100
|
|
|
6aec805 |
@@ -45,8 +45,6 @@ public:
|
|
|
6aec805 |
|
|
|
6aec805 |
virtual void attach();
|
|
|
6aec805 |
virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
|
|
|
6aec805 |
- virtual void insertedIntoDocument();
|
|
|
6aec805 |
- virtual void removedFromDocument();
|
|
|
6aec805 |
|
|
|
6aec805 |
virtual bool canStartSelection() const { return false; }
|
|
|
6aec805 |
|
|
|
6aec805 |
@@ -105,6 +103,11 @@ public:
|
|
|
6aec805 |
virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
|
|
|
6aec805 |
|
|
|
6aec805 |
private:
|
|
|
6aec805 |
+ virtual void insertedIntoDocument();
|
|
|
6aec805 |
+ virtual void removedFromDocument();
|
|
|
6aec805 |
+ virtual void insertedIntoTree(bool deep);
|
|
|
6aec805 |
+ virtual void removedFromTree(bool deep);
|
|
|
6aec805 |
+
|
|
|
6aec805 |
HTMLImageLoader m_imageLoader;
|
|
|
6aec805 |
String usemap;
|
|
|
6aec805 |
bool ismap;
|