Title: [101612] trunk
- Revision
- 101612
- Author
- commit-qu...@webkit.org
- Date
- 2011-11-30 22:38:02 -0800 (Wed, 30 Nov 2011)
Log Message
XHR 'progress' event code assumes wrongly that expectedLength >= 0
https://bugs.webkit.org/show_bug.cgi?id=36156
Source/WebCore:
Patch by Hans Muller <hmul...@adobe.com> on 2011-11-30
Reviewed by Alexey Proskuryakov
Avoid passing a negative value as the dispatchProgressEvent's total parameter and always use 0 when lengthComputable is false.
Test: http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::didReceiveData):
LayoutTests:
Patch by Hans Muller <hmul...@adobe.com> on 2011-11-30
Reviewed by Alexey Proskuryakov
Verify that XMLHttpRequest ProgressEvent's total is zero when the expectedLength of the
(chunked transfer mode) response can't be computed.
* http/tests/xmlhttprequest/chunked-progress-event-expectedLength-expected.txt: Added.
* http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html: Added.
* http/tests/xmlhttprequest/resources/chunked-transfer.php: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (101611 => 101612)
--- trunk/LayoutTests/ChangeLog 2011-12-01 06:30:11 UTC (rev 101611)
+++ trunk/LayoutTests/ChangeLog 2011-12-01 06:38:02 UTC (rev 101612)
@@ -1,3 +1,17 @@
+2011-11-30 Hans Muller <hmul...@adobe.com>
+
+ XHR 'progress' event code assumes wrongly that expectedLength >= 0
+ https://bugs.webkit.org/show_bug.cgi?id=36156
+
+ Reviewed by Alexey Proskuryakov
+
+ Verify that XMLHttpRequest ProgressEvent's total is zero when the expectedLength of the
+ (chunked transfer mode) response can't be computed.
+
+ * http/tests/xmlhttprequest/chunked-progress-event-expectedLength-expected.txt: Added.
+ * http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html: Added.
+ * http/tests/xmlhttprequest/resources/chunked-transfer.php: Added.
+
2011-11-30 Hayato Ito <hay...@chromium.org>
Unreviewed. Update chromium test expectations, adding one more inspector test crash.
Added: trunk/LayoutTests/http/tests/xmlhttprequest/chunked-progress-event-expectedLength-expected.txt (0 => 101612)
--- trunk/LayoutTests/http/tests/xmlhttprequest/chunked-progress-event-expectedLength-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/xmlhttprequest/chunked-progress-event-expectedLength-expected.txt 2011-12-01 06:38:02 UTC (rev 101612)
@@ -0,0 +1,7 @@
+Test case for bug 36156: XHR 'progress' event code assumes wrongly that expectedLength >= 0
+
+Verify that the progress event total property is 0 when the expected overall length can't be computed.
+
+PASS should appear below:
+
+PASS
Added: trunk/LayoutTests/http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html (0 => 101612)
--- trunk/LayoutTests/http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html (rev 0)
+++ trunk/LayoutTests/http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html 2011-12-01 06:38:02 UTC (rev 101612)
@@ -0,0 +1,46 @@
+<html>
+<head>
+<title>Test case for bug 36156</title>
+</head>
+<body>
+<p> Test case for <a href="" bug 36156</a>: XHR 'progress' event code assumes wrongly that expectedLength >= 0</p>
+<p> Verify that the progress event total property is 0 when the expected overall length can't be computed.<p>
+<p>PASS should appear below:</p>
+<p id=console></p>
+<script type="text/_javascript_">
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function log(message)
+{
+ document.getElementById('console').appendChild(document.createTextNode(message + '\n'));
+}
+
+function test()
+{
+ var xhr = new XMLHttpRequest();
+ xhr.open("GET", "resources/chunked-transfer.php", true);
+
+ xhr._onprogress_ = function(e) {
+ if (e.loaded == 4 && e.total == 0 && !e.lengthComputable)
+ log("PASS");
+ else if (e.total != 0 && !e.lengthComputable)
+ log("FAIL: XMLHttpRequestProgressEvent lengthComputable=false but total is non-zero: " + e.total);
+ }
+
+ xhr._onreadystatechange_ = function(e) {
+ if (xhr.readyState == xhr.DONE)
+ {
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+ }
+
+ xhr.send();
+}
+
+test();
+</script>
+</body>
Added: trunk/LayoutTests/http/tests/xmlhttprequest/resources/chunked-transfer.php (0 => 101612)
--- trunk/LayoutTests/http/tests/xmlhttprequest/resources/chunked-transfer.php (rev 0)
+++ trunk/LayoutTests/http/tests/xmlhttprequest/resources/chunked-transfer.php 2011-12-01 06:38:02 UTC (rev 101612)
@@ -0,0 +1,7 @@
+<?php
+header("Transfer-encoding: chunked");
+flush();
+printf("4\r\n<a/>\r\n");
+flush();
+printf("0\r\n\r\n");
+?>
Modified: trunk/Source/WebCore/ChangeLog (101611 => 101612)
--- trunk/Source/WebCore/ChangeLog 2011-12-01 06:30:11 UTC (rev 101611)
+++ trunk/Source/WebCore/ChangeLog 2011-12-01 06:38:02 UTC (rev 101612)
@@ -1,3 +1,17 @@
+2011-11-30 Hans Muller <hmul...@adobe.com>
+
+ XHR 'progress' event code assumes wrongly that expectedLength >= 0
+ https://bugs.webkit.org/show_bug.cgi?id=36156
+
+ Reviewed by Alexey Proskuryakov
+
+ Avoid passing a negative value as the dispatchProgressEvent's total parameter and always use 0 when lengthComputable is false.
+
+ Test: http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html
+
+ * xml/XMLHttpRequest.cpp:
+ (WebCore::XMLHttpRequest::didReceiveData):
+
2011-11-30 Gyuyoung Kim <gyuyoung....@samsung.com>
Unreviewed. Fix build error when NOTIFICATIONS feature is enabled.
Modified: trunk/Source/WebCore/xml/XMLHttpRequest.cpp (101611 => 101612)
--- trunk/Source/WebCore/xml/XMLHttpRequest.cpp 2011-12-01 06:30:11 UTC (rev 101611)
+++ trunk/Source/WebCore/xml/XMLHttpRequest.cpp 2011-12-01 06:38:02 UTC (rev 101612)
@@ -1080,8 +1080,9 @@
m_receivedLength += len;
if (m_async) {
- bool lengthComputable = expectedLength && m_receivedLength <= expectedLength;
- m_progressEventThrottle.dispatchProgressEvent(lengthComputable, m_receivedLength, expectedLength);
+ bool lengthComputable = expectedLength > 0 && m_receivedLength <= expectedLength;
+ unsigned long long total = lengthComputable ? expectedLength : 0;
+ m_progressEventThrottle.dispatchProgressEvent(lengthComputable, m_receivedLength, total);
}
if (m_state != LOADING)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
