Merge r183053 - REGRESSION (r177494): -webkit-mask-image: with data U…

…RI fails on non-local files https://bugs.webkit.org/show_bug.cgi?id=141857 Reviewed by Dirk Schulze. Source/WebCore: r177494 regressed loading of data URIs in masks with remote content, triggering a cross-domain error which occurs because the mask loading happened via a separate SVGDocument. Fix by checking for data URIs at parsing time, which is what we used to do. Test: http/tests/css/data-uri-mask.html * css/CSSParser.cpp: (WebCore::CSSParser::parseMaskImage): * svg/SVGURIReference.h: (WebCore::SVGURIReference::isExternalURIReference): LayoutTests: Ref test with a masked green square. Has to be an http test to trigger the origin checking. * http/tests/css/data-uri-mask-expected.html: Added. * http/tests/css/data-uri-mask.html: Added.
WebKit · May 11, 2015 · 3c5c6c6 · 3c5c6c6
1 parent 39e7e92
commit 3c5c6c6
Show file tree

Hide file tree

Showing 6 changed files with 81 additions and 7 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2015-04-20  Simon Fraser  <simon.fraser@apple.com>
+
+        REGRESSION (r177494): -webkit-mask-image: with data URI fails on non-local files
+        https://bugs.webkit.org/show_bug.cgi?id=141857
+
+        Reviewed by Dirk Schulze.
+
+        Ref test with a masked green square. Has to be an http test to trigger the
+        origin checking.
+
+        * http/tests/css/data-uri-mask-expected.html: Added.
+        * http/tests/css/data-uri-mask.html: Added.
+
 2015-04-17  Bem Jones-Bey  <bjonesbe@adobe.com>
 
         Large values for line-height cause integer overflow in RenderStyle::computedLineHeight

diff --git a/LayoutTests/http/tests/css/data-uri-mask-expected.html b/LayoutTests/http/tests/css/data-uri-mask-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+    <style>
+        .masked {
+            height: 100px;
+            width: 100px;
+            background-color: green;
+        }
+    </style>
+</head>
+<body>
+    <div class="masked"></div>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/css/data-uri-mask.html b/LayoutTests/http/tests/css/data-uri-mask.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+    <style>
+        .masked {
+            height: 100px;
+            width: 100px;
+            background-color: green;
+            -webkit-mask-image: url(data:image/png;base64,R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICRAEAOw==);
+        }
+    </style>
+</head>
+<body>
+    <div class="masked"></div>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2015-04-20  Simon Fraser  <simon.fraser@apple.com>
+
+        REGRESSION (r177494): -webkit-mask-image: with data URI fails on non-local files
+        https://bugs.webkit.org/show_bug.cgi?id=141857
+
+        Reviewed by Dirk Schulze.
+
+        r177494 regressed loading of data URIs in masks with remote content, triggering
+        a cross-domain error which occurs because the mask loading happened via a separate
+        SVGDocument.
+
+        Fix by checking for data URIs at parsing time, which is what we used to do.
+
+        Test: http/tests/css/data-uri-mask.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseMaskImage):
+        * svg/SVGURIReference.h:
+        (WebCore::SVGURIReference::isExternalURIReference):
+
 2015-04-17  Bem Jones-Bey  <bjonesbe@adobe.com>
 
         Large values for line-height cause integer overflow in RenderStyle::computedLineHeight

diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
@@ -9574,16 +9574,23 @@ bool CSSParser::parseMaskImage(CSSParserValueList& valueList, RefPtr<CSSValue>&
 {
     outValue = nullptr;
     CSSParserValue* value = valueList.current();
-    if (value->id == CSSValueNone)
+    if (value->id == CSSValueNone) {
         outValue = WebKitCSSResourceValue::create(cssValuePool().createIdentifierValue(CSSValueNone));
-    else if (value->unit == CSSPrimitiveValue::CSS_URI)
-        outValue = WebKitCSSResourceValue::create(CSSPrimitiveValue::create(completeURL(value->string), CSSPrimitiveValue::CSS_URI));
-    else {
-        RefPtr<CSSValue> fillImageValue;
-        if (parseFillImage(valueList, fillImageValue))
-            outValue = WebKitCSSResourceValue::create(fillImageValue);
+        return outValue.get();
     }
 
+    RefPtr<CSSValue> resourceValue;
+    if (value->unit == CSSPrimitiveValue::CSS_URI) {
+        if (protocolIs(value->string, "data"))
+            parseFillImage(valueList, resourceValue);
+        else
+            resourceValue = CSSPrimitiveValue::create(completeURL(value->string), CSSPrimitiveValue::CSS_URI);
+    } else
+        parseFillImage(valueList, resourceValue);
+
+    if (resourceValue)
+        outValue = WebKitCSSResourceValue::create(resourceValue);
+
     return outValue.get();
 }
 

diff --git a/Source/WebCore/svg/SVGURIReference.h b/Source/WebCore/svg/SVGURIReference.h
@@ -48,6 +48,7 @@ class SVGURIReference {
 
         // If the URI matches our documents URL, we're dealing with a local reference.
         URL url = document.completeURL(uri);
+        ASSERT(!url.protocolIsData());
         return !equalIgnoringFragmentIdentifier(url, document.url());
     }