From cdd20e3a6c7ea615f820cc28aa7c7029042c5f7a Mon Sep 17 00:00:00 2001 From: Mason Freed Date: Wed, 4 Aug 2021 10:09:57 -0700 Subject: [PATCH] Fix with CSS content The LayoutObject creation was previously being performed via a call to LayoutObjectFactory::CreateBlockFlow() and a conditional on the style to LayoutInline(). This CL replaces all of that with a call to LayoutObject::CreateObject(), which handles creating the correct LayoutObject type, plus it also (now) handles CSS content pointing to an image. Previous attempts to do this [1][2] fixed some of these issues, but left a UAF in ImageResourceContent::RemoveObserver() [3]. To fix this, an unnecessary call to SetImageResource() in ImageInputType::OnAttachWithLayoutObject() was removed. Test coverage: Fallback content display type: external/wpt/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/input-image-inline-alt.html UAF: external/wpt/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/input-image-content-crash.html CSS content (new test): external/wpt/html/rendering/replaced-elements/images/input-image-content.html [1] crrev.com/779108 [2] crrev.com/780992 [3] https://bugs.chromium.org/p/chromium/issues/detail?id=1226558#c7 Fixed: 1226558 Change-Id: I64c61ebed91670b5fac665f1c4be9337f0814a9a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3064330 Commit-Queue: Ian Kilpatrick Auto-Submit: Mason Freed Reviewed-by: Ian Kilpatrick Cr-Commit-Position: refs/heads/master@{#908495} --- .../input-image-content-crash.html | 4 +--- .../images/input-image-content-ref.html | 7 +++++++ .../images/input-image-content.html | 14 ++++++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) create mode 100644 html/rendering/replaced-elements/images/input-image-content-ref.html create mode 100644 html/rendering/replaced-elements/images/input-image-content.html diff --git a/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/input-image-content-crash.html b/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/input-image-content-crash.html index afeba98912d970..84ef2ab1539e15 100644 --- a/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/input-image-content-crash.html +++ b/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/input-image-content-crash.html @@ -5,11 +5,9 @@ - +