summaryrefslogtreecommitdiffstats
path: root/src/3rdparty/webkit/WebCore
diff options
context:
space:
mode:
authorSimon Hausmann <simon.hausmann@nokia.com>2010-05-11 10:26:30 (GMT)
committerSimon Hausmann <simon.hausmann@nokia.com>2010-05-11 10:26:30 (GMT)
commit3eec5af3f07fdab9084f40d6955411a667b433c4 (patch)
tree3ab9f1f7b2d080053b9e9376e2d13016d5e6421d /src/3rdparty/webkit/WebCore
parentb4c589868f278aa9a58ab9afa727dbf0a9442e22 (diff)
downloadQt-3eec5af3f07fdab9084f40d6955411a667b433c4.zip
Qt-3eec5af3f07fdab9084f40d6955411a667b433c4.tar.gz
Qt-3eec5af3f07fdab9084f40d6955411a667b433c4.tar.bz2
Updated WebKit to b4aa5e1ddc41edab895132aba3cc66d9d7129444
Integrated changes: || <https://webkit.org/b/38747> || mingw-w64 and JIT support || || <https://webkit.org/b/38119> || [Qt] QWebPage viewMode property || || <https://webkit.org/b/37097> || [Qt] Fix infinite redirection loop in QNetworkReplyHandler || || <https://webkit.org/b/38668> || [Qt] Enable YARR_JIT for X86 Mac for QtWebKit || || <https://webkit.org/b/38834> || [Qt] Adapt DNS pre-fetching to Qt DNS cache code || || <https://webkit.org/b/38574> || [Qt] Crash in QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate when animation were used || || <https://webkit.org/b/31407> || [PATCH] [Qt] Compilation with Plugins disabled is broken || || <https://webkit.org/b/38514> || Crash in handleTouchEvent: using dangling node ptrs in hashmap || || <https://webkit.org/b/38646> || Potential crash in EventHandler::handleTouchEvent || || <https://webkit.org/b/38488> || Spatial Navigation: create a getter for the "fudgeFactor" || || <https://webkit.org/b/38523> || [Qt] QtWebKit has render bugs on Google Maps markers || || <https://webkit.org/b/37276> || LayoutTests/fast/canvas/pointInPath.html passed, actually it failed || || <https://webkit.org/b/37023> || [Qt] Expose HTMLTokenizer yielding parameters ||
Diffstat (limited to 'src/3rdparty/webkit/WebCore')
-rw-r--r--src/3rdparty/webkit/WebCore/ChangeLog163
-rw-r--r--src/3rdparty/webkit/WebCore/WebCore.gypi2
-rw-r--r--src/3rdparty/webkit/WebCore/WebCore.pro2
-rw-r--r--src/3rdparty/webkit/WebCore/page/EventHandler.cpp13
-rw-r--r--src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp13
-rw-r--r--src/3rdparty/webkit/WebCore/page/SpatialNavigation.h5
-rw-r--r--src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp16
-rw-r--r--src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp29
-rw-r--r--src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h11
-rw-r--r--src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp13
-rw-r--r--src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h1
-rw-r--r--src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubsQt.cpp (renamed from src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp)0
12 files changed, 246 insertions, 22 deletions
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 6617b66..ee42878 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,166 @@
+2010-05-03 Antonio Gomes <tonikitoo@webkit.org>
+
+ Reviewed by Kenneth Christiansen.
+
+ Spatial Navigation: create a getter for the "fudgeFactor"
+ https://bugs.webkit.org/show_bug.cgi?id=38488
+
+ A couple of places in the Spatial Navigation code make use of a "fudge factor"
+ to improve precision by working around outline focus metrics and such. Patch adds
+ a helper method for unify getter operations of this value, instead of having it
+ declared locally in the various methods it is used.
+
+ No behaviour change.
+
+ * page/SpatialNavigation.cpp:
+ (WebCore::scrollIntoView):
+ (WebCore::deflateIfOverlapped):
+ * page/SpatialNavigation.h:
+ (WebCore::fudgeFactor):
+
+2010-05-10 Markus Goetz <Markus.Goetz@nokia.com>
+
+ Reviewed by Simon Hausmann.
+
+ Qt after 4.6.3 has its integrated DNS cache. Therefore some
+ code is not necessary anymore.
+
+ https://bugs.webkit.org/show_bug.cgi?id=38834
+
+ * platform/network/qt/DnsPrefetchHelper.h:
+ (WebCore::DnsPrefetchHelper::lookup):
+ (WebCore::DnsPrefetchHelper::lookedUp):
+
+2010-05-06 Laszlo Gombos <laszlo.1.gombos@nokia.com>
+
+ Unreviewed, build fix WinCE for QtWebKit.
+
+ [Qt] Compilation with Plugins disabled is broken
+ https://bugs.webkit.org/show_bug.cgi?id=31407
+
+ Rename platform/qt/TemporaryLinkStubs.cpp to avoid name collition on
+ Windows.
+
+ Thanks for Ismail "cartman" Donmez for help.
+
+ No new tests, as there is no new functionality.
+
+ * WebCore.gypi:
+ * WebCore.pro:
+ * platform/qt/TemporaryLinkStubs.cpp: Removed.
+ * platform/qt/TemporaryLinkStubsQt.cpp: Copied from WebCore/platform/qt/TemporaryLinkStubs.cpp.
+
+2010-04-23 Qi Zhang <qi.2.zhang@nokia.com>
+
+ Reviewed by Laszlo Gombos.
+
+ [Qt] LayoutTests/fast/canvas/pointInPath.html passed, actually it failed
+ https://bugs.webkit.org/show_bug.cgi?id=37276
+
+ QPainterPath::contains doesn't count the point on the bound.
+
+ * platform/graphics/qt/PathQt.cpp:
+ (WebCore::isPointOnPathBorder):
+ (WebCore::Path::contains):
+
+2010-05-07 Tor Arne Vestbø <tor.arne.vestbo@nokia.com>
+
+ Reviewed by Simon Hausmann.
+
+ [Qt] Fix rendering of -webkit-user-select: none
+
+ -webkit-user-select: none is implemented by filling
+ the area with an invalid default-constructed Color.
+ In most ports passing an invalid color down to the
+ graphics backend seems to produce transparent fills.
+
+ In Qt the behavior of painting with an invalid QColor
+ is undefined, and in practice it results in painting
+ black opaque areas.
+
+ One way to fix this would be to use Qt::transparent
+ when converting an undefined Color to a QColor, but
+ Qt does not have short circuits for fully transparent
+ painting, and we actually end up in slow code paths
+ due to the transparency. So, we're better of doing the
+ short circuit in WebKit.
+
+ https://bugs.webkit.org/show_bug.cgi?id=38523
+
+ * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-04-05 Robert Hogan <robert@webkit.org>
+
+ Reviewed by Kenneth Rohde Christiansen.
+
+ [Qt] Fix infinite redirection loop in QNetworkReplyHandler
+
+ Put a maximum on consecutive redirections so we don't have to
+ worry about whether it's the same url or not.
+
+ Tolerate up to 10 consecutive redirections, anything beyond
+ that is considered a potentially infinite recursion in the
+ redirection requests. This is the same behaviour as Firefox.
+
+ https://bugs.webkit.org/show_bug.cgi?id=37097
+
+ * platform/network/qt/QNetworkReplyHandler.cpp:
+ (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+ (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+ * platform/network/qt/QNetworkReplyHandler.h:
+
+2010-04-05 Robert Hogan <robert@webkit.org>
+
+ Reviewed by Kenneth Rohde-Christiansen.
+
+ [Qt] Fix infinite redirection loop in QNetworkReplyHandler
+
+ Qt enters an infinite loop if a redirect response redirects to itself.
+
+ Fixes http/tests/xmlhttprequest/connection-error-sync.html
+
+ https://bugs.webkit.org/show_bug.cgi?id=37097
+
+ * platform/network/qt/QNetworkReplyHandler.cpp:
+ (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2010-05-07 Ben Murdoch <benm@google.com>
+
+ Reviewed by Darin Adler.
+
+ Potential crash in EventHandler::handleTouchEvent
+ https://bugs.webkit.org/show_bug.cgi?id=38646
+
+ Fix a ref counting bug that can cause a crash if the m_originatingouchPointTargets
+ hashmap holds the last ref to an EventTarget when the user lifts their finger.
+
+ This is very hard to reproduce in a consistent way and clearly a
+ simple logic error in the code, therefore no new tests.
+
+ * page/EventHandler.cpp:
+ (WebCore::EventHandler::handleTouchEvent): Don't let the RefPtr we get back from
+ the hasmap go out of scope so soon as it could delete the wrapped ptr if the
+ hashmap held the last ref (and we use the raw ptr that the RefPtr
+ wraps later in the WebCore::Touch constructor).
+
+2010-05-04 Ben Murdoch <benm@google.com>
+
+ Reviewed by Simon Hausmann.
+
+ Crash in handleTouchEvent: using dangling node ptrs in hashmap
+ https://bugs.webkit.org/show_bug.cgi?id=38514
+
+ When navigating away from a page, if you have your finger still
+ pressed and then lift it on the new page we see a crash if the
+ node got deleted as we still have a dangling pointer in the
+ m_originatingTouchPointTargets hashmap and try to use it as the
+ receiver to dispatch a touchend event.
+
+ Test: fast/events/touch/touch-stale-node-crash.html
+
+ * page/EventHandler.cpp:
+ (WebCore::EventHandler::clear): Clear the hashmap of touch targets.
+
2010-05-04 Luiz Agostini <luiz.agostini@openbossa.org>
Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index caa79f2..701ad90 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -2640,7 +2640,7 @@
'platform/qt/SharedBufferQt.cpp',
'platform/qt/SharedTimerQt.cpp',
'platform/qt/SoundQt.cpp',
- 'platform/qt/TemporaryLinkStubs.cpp',
+ 'platform/qt/TemporaryLinkStubsQt.cpp',
'platform/qt/WheelEventQt.cpp',
'platform/qt/WidgetQt.cpp',
'platform/sql/SQLValue.cpp',
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index beeb529..e42cd8e 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -2081,7 +2081,7 @@ SOURCES += \
platform/qt/SoundQt.cpp \
platform/qt/LoggingQt.cpp \
platform/text/qt/StringQt.cpp \
- platform/qt/TemporaryLinkStubs.cpp \
+ platform/qt/TemporaryLinkStubsQt.cpp \
platform/text/qt/TextBoundariesQt.cpp \
platform/text/qt/TextBreakIteratorQt.cpp \
platform/text/qt/TextCodecQt.cpp \
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 0a0e8c6..46dd7ae 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -230,6 +230,9 @@ void EventHandler::clear()
m_capturingMouseEventsNode = 0;
m_latchedWheelEventNode = 0;
m_previousWheelScrolledNode = 0;
+#if ENABLE(TOUCH_EVENTS)
+ m_originatingTouchPointTargets.clear();
+#endif
}
void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
@@ -2714,21 +2717,21 @@ bool EventHandler::handleTouchEvent(const PlatformTouchEvent& event)
// Increment the platform touch id by 1 to avoid storing a key of 0 in the hashmap.
unsigned touchPointTargetKey = point.id() + 1;
- EventTarget* touchTarget = 0;
+ RefPtr<EventTarget> touchTarget;
if (point.state() == PlatformTouchPoint::TouchPressed) {
m_originatingTouchPointTargets.set(touchPointTargetKey, target);
touchTarget = target;
} else if (point.state() == PlatformTouchPoint::TouchReleased || point.state() == PlatformTouchPoint::TouchCancelled) {
// The target should be the original target for this touch, so get it from the hashmap. As it's a release or cancel
// we also remove it from the map.
- touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey).get();
+ touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey);
} else
- touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey).get();
+ touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey);
- if (!touchTarget)
+ if (!touchTarget.get())
continue;
- RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget, point.id(),
+ RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget.get(), point.id(),
point.screenPos().x(), point.screenPos().y(),
adjustedPageX, adjustedPageY);
diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
index 890eacd..d7eaf25 100644
--- a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
@@ -477,9 +477,8 @@ void scrollIntoView(Element* element)
// it is preferable to inflate |element|'s bounding rect a bit before
// scrolling it for accurate reason.
// Element's scrollIntoView method does not provide this flexibility.
- static const int fudgeFactor = 2;
IntRect bounds = element->getRect();
- bounds.inflate(fudgeFactor);
+ bounds.inflate(fudgeFactor());
element->renderer()->enclosingLayer()->scrollRectToVisible(bounds);
}
@@ -497,14 +496,14 @@ static void deflateIfOverlapped(IntRect& a, IntRect& b)
if (!a.intersects(b) || a.contains(b) || b.contains(a))
return;
- static const int fudgeFactor = -2;
+ int deflateFactor = -fudgeFactor();
// Avoid negative width or height values.
- if ((a.width() + 2 * fudgeFactor > 0) && (a.height() + 2 * fudgeFactor > 0))
- a.inflate(fudgeFactor);
+ if ((a.width() + 2 * deflateFactor > 0) && (a.height() + 2 * deflateFactor > 0))
+ a.inflate(deflateFactor);
- if ((b.width() + 2 * fudgeFactor > 0) && (b.height() + 2 * fudgeFactor > 0))
- b.inflate(fudgeFactor);
+ if ((b.width() + 2 * deflateFactor > 0) && (b.height() + 2 * deflateFactor > 0))
+ b.inflate(deflateFactor);
}
static bool checkNegativeCoordsForNode(Node* node, const IntRect& curRect)
diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
index 90ff1cf..309b095 100644
--- a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
+++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
@@ -40,6 +40,11 @@ inline long long maxDistance()
return numeric_limits<long long>::max();
}
+inline unsigned int fudgeFactor()
+{
+ return 2;
+}
+
// Spatially speaking, two given elements in a web page can be:
// 1) Fully aligned: There is a full intersection between the rects, either
// vertically or horizontally.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index edac268..0100b72 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -641,12 +641,12 @@ void GraphicsContext::fillRect(const FloatRect& rect)
}
}
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace colorSpace)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
{
- if (paintingDisabled())
+ if (paintingDisabled() || !color.isValid())
return;
- m_data->solidColor.setColor(c);
+ m_data->solidColor.setColor(color);
QPainter* p = m_data->p();
if (m_common->state.shadowColor.isValid())
drawBorderlessRectShadow(this, p, rect);
@@ -655,7 +655,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace
void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
{
- if (paintingDisabled() || !color.alpha())
+ if (paintingDisabled() || !color.isValid() || !color.alpha())
return;
Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
@@ -717,7 +717,7 @@ void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int of
*/
void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int /* width */, int /* offset */, const Color& color)
{
- if (paintingDisabled())
+ if (paintingDisabled() || !color.isValid())
return;
unsigned rectCount = rects.size();
@@ -1141,8 +1141,9 @@ void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
{
- if (paintingDisabled())
+ if (paintingDisabled() || !color.isValid())
return;
+
QPainter* p = m_data->p();
QPen newPen(p->pen());
m_data->solidColor.setColor(color);
@@ -1172,8 +1173,9 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
{
- if (paintingDisabled())
+ if (paintingDisabled() || !color.isValid())
return;
+
m_data->solidColor.setColor(color);
m_data->p()->setBrush(m_data->solidColor);
}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
index ee4af7f..4b0c21f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
@@ -69,12 +69,41 @@ Path& Path::operator=(const Path& other)
return *this;
}
+// Check whether a point is on the border
+bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
+{
+ QPointF p1 = border.at(0);
+ QPointF p2;
+
+ for (int i = 1; i < border.size(); ++i) {
+ p2 = border.at(i);
+ // (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2) && (y2-y1)(x-x1) == (y-y1)(x2-x1)
+ // In which, (y2-y1)(x-x1) == (y-y1)(x2-x1) is from (y2-y1)/(x2-x1) == (y-y1)/(x-x1)
+ // it want to check the slope between p1 and p2 is same with slope between p and p1,
+ // if so then the three points lie on the same line.
+ // In which, (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2) want to make sure p is
+ // between p1 and p2, not outside.
+ if (((p.x() <= p1.x() && p.x() >= p2.x()) || (p.x() >= p1.x() && p.x() <= p2.x()))
+ && ((p.y() <= p1.y() && p.y() >= p2.y()) || (p.y() >= p1.y() && p.y() <= p2.y()))
+ && (p2.y() - p1.y()) * (p.x() - p1.x()) == (p.y() - p1.y()) * (p2.x() - p1.x())) {
+ return true;
+ }
+ p1 = p2;
+ }
+ return false;
+}
+
bool Path::contains(const FloatPoint& point, WindRule rule) const
{
Qt::FillRule savedRule = m_path.fillRule();
const_cast<QPainterPath*>(&m_path)->setFillRule(rule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
bool contains = m_path.contains(point);
+
+ if (!contains) {
+ // check whether the point is on the border
+ contains = isPointOnPathBorder(m_path.toFillPolygon(), point);
+ }
const_cast<QPainterPath*>(&m_path)->setFillRule(savedRule);
return contains;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
index 0d98fcb..e355025 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -42,6 +42,13 @@ namespace WebCore {
if (currentLookups >= 10)
return; // do not launch more than 10 lookups at the same time
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 3)
+ currentLookups++;
+ QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
+#else
+ // This code is only needed for Qt versions that do not have
+ // the small Qt DNS cache yet.
+
QTime* entryTime = lookupCache.object(hostname);
if (entryTime && entryTime->elapsed() > 300*1000) {
// delete knowledge about lookup if it is already 300 seconds old
@@ -54,6 +61,7 @@ namespace WebCore {
currentLookups++;
QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
}
+#endif
}
void lookedUp(const QHostInfo&)
@@ -61,11 +69,14 @@ namespace WebCore {
// we do not cache the result, we throw it away.
// we currently rely on the OS to cache the results. If it does not do that
// then at least the ISP nameserver did it.
+ // Since Qt 4.6.3, Qt also has a small DNS cache.
currentLookups--;
}
protected:
+#if QT_VERSION < QT_VERSION_CHECK(4, 6, 3)
QCache<QString, QTime> lookupCache; // 100 entries
+#endif
int currentLookups;
};
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 403718f..abeb895 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -49,6 +49,7 @@
#define SIGNAL_CONN Qt::QueuedConnection
#endif
+static const int gMaxRecursionLimit = 10;
namespace WebCore {
@@ -139,6 +140,7 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
, m_shouldFinish(false)
, m_shouldSendResponse(false)
, m_shouldForwardData(false)
+ , m_redirectionTries(gMaxRecursionLimit)
{
const ResourceRequest &r = m_resourceHandle->request();
@@ -336,9 +338,18 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
if (redirection.isValid()) {
+ QUrl newUrl = m_reply->url().resolved(redirection);
+
+ m_redirectionTries--;
+ if (m_redirectionTries == 0) { // 10 or more redirections to the same url is considered infinite recursion
+ ResourceError error(newUrl.host(), 400 /*bad request*/,
+ newUrl.toString(),
+ QCoreApplication::translate("QWebPage", "Redirection limit reached"));
+ client->didFail(m_resourceHandle, error);
+ return;
+ }
m_redirected = true;
- QUrl newUrl = m_reply->url().resolved(redirection);
ResourceRequest newRequest = m_resourceHandle->request();
newRequest.setURL(newUrl);
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index eb5ae3c..1abad4e 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -82,6 +82,7 @@ private:
bool m_shouldFinish;
bool m_shouldSendResponse;
bool m_shouldForwardData;
+ int m_redirectionTries;
};
// Self destructing QIODevice for FormData
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubsQt.cpp
index 814f961..814f961 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubsQt.cpp