Bug Summary

File:Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore/html/HTMLObjectElement.cpp
Warning:line 300, column 25
Call argument for 'this' parameter is uncounted and unsafe

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple arm64-apple-ios26.2.0-simulator -O3 -Wundef-prefix=TARGET_OS_ -Werror=undef-prefix -Wdeprecated-objc-isa-usage -Werror=deprecated-objc-isa-usage -Werror=implicit-function-declaration -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name UnifiedSource225.cpp -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=osx -analyzer-checker=security.insecureAPI.decodeValueOfObjCType -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -mframe-pointer=non-leaf -ffp-contract=on -fno-rounding-math -target-sdk-version=26.2 -fdepfile-entry=/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/SDKSettings.json -fcompatibility-qualified-id-block-type-checking -fvisibility-inlines-hidden-static-local-var -fno-modulemap-allow-subdirectory-search -fdefine-target-os-macros -enable-tlsdesc -target-cpu apple-m1 -target-feature +v8.4a -target-feature +aes -target-feature +altnzcv -target-feature +ccdp -target-feature +ccpp -target-feature +complxnum -target-feature +crc -target-feature +dotprod -target-feature +flagm -target-feature +fp-armv8 -target-feature +fp16fml -target-feature +fptoint -target-feature +fullfp16 -target-feature +jsconv -target-feature +lse -target-feature +neon -target-feature +pauth -target-feature +perfmon -target-feature +predres -target-feature +ras -target-feature +rcpc -target-feature +rdm -target-feature +sb -target-feature +sha2 -target-feature +sha3 -target-feature +specrestrict -target-feature +ssbs -target-abi darwinpcs -dwarf-ext-refs -fmodule-format=obj -debug-info-kind=standalone -dwarf-version=5 -debugger-tuning=lldb -fdebug-compilation-dir=/Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore -target-linker-version 1230.1 -fcoverage-compilation-dir=/Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore -resource-dir /Users/buildbot/Library/Developer/Toolchains/swift-webkit.xctoolchain/usr/lib/clang/21 -dependency-file /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/scan-build-output/StaticAnalyzer/WebCore/WebCore/normal/arm64/UnifiedSource225.d -skip-unused-modulemap-deps -MT dependencies -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk -iquote /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/WebCore-generated-files.hmap -iquote /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/WebCore-project-headers.hmap -isystem /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore/PAL/ThirdParty/dav1d/include -isystem /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/SDKAdditions/usr/include -iframework /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/SDKAdditions/System/Library/Frameworks -iframework /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitLibraries/SDKs/iphonesimulator26.0-additions.sdk/System/Library/PrivateFrameworks -iframework /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/System/Library/Frameworks -include-pch /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/PrecompiledHeaders/SharedPrecompiledHeaders/11721353671419897710/WebCorePrefix.h.gch -D _LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE -D NDEBUG -D BUILDING_WEBKIT -D GL_SILENCE_DEPRECATION=1 -D GLES_SILENCE_DEPRECATION=1 -D __clang_analyzer__ -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/WebCore-own-target-headers.hmap -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/WebCore-all-target-headers.hmap -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/include -I PAL -I ForwardingHeaders -I /usr/include/libxslt -I /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/include/libxml2 -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/DerivedSources/WebCore -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/usr/local/include -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/usr/local/include/WebKitAdditions -I /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/local/include/WebKitAdditions -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/usr/local/include -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitLibraries/SDKs/iphonesimulator26.0-additions.sdk/usr/local/include -I /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/local/include -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/usr/local/include/webrtc -I /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/local/include/webrtc -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/usr/local/include/webm -I /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/local/include/webm -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/PAL.build/PAL.build/DerivedSources -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/PAL.build/Release-iphonesimulator/PAL.build/DerivedSources -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/Source/WebCore -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/DerivedSources-normal/arm64 -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/DerivedSources/arm64 -I /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/WebCore.build/Release-iphonesimulator/WebCore.build/DerivedSources -F/Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator -F/Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator -I/usr/local/include -stdlib=libc++ -internal-isystem /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/include/c++/v1 -internal-isystem /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/local/include -internal-isystem /Users/buildbot/Library/Developer/Toolchains/swift-webkit.xctoolchain/usr/lib/clang/21/include -internal-externc-isystem /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/usr/include -internal-iframework /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/System/Library/Frameworks -internal-iframework /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/System/Library/SubFrameworks -internal-iframework /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.2.sdk/Library/Frameworks -Wno-trigraphs -Werror -Wno-missing-field-initializers -Wmissing-prototypes -Wunreachable-code -Wnon-virtual-dtor -Wno-overloaded-virtual -Wno-exit-time-destructors -Wno-missing-braces -Wparentheses -Wswitch -Wunused-function -Wno-unused-label -Wno-unused-parameter -Wunused-variable -Wunused-value -Wempty-body -Wuninitialized -Wno-unknown-pragmas -Wno-shadow -Wno-four-char-constants -Wno-conversion -Wconstant-conversion -Wint-conversion -Wbool-conversion -Wenum-conversion -Wno-float-conversion -Wnon-literal-null-conversion -Wobjc-literal-conversion -Wsign-compare -Wno-shorten-64-to-32 -Wnewline-eof -Wno-c++11-extensions -Wno-implicit-fallthrough -Wdeprecated-declarations -Winvalid-offsetof -Wno-sign-conversion -Winfinite-recursion -Wmove -Wcomma -Wblock-capture-autoreleasing -Wstrict-prototypes -Wrange-loop-analysis -Wno-semicolon-before-method-body -Wall -Wc99-designator -Wconditional-uninitialized -Wextra -Wdeprecated-enum-enum-conversion -Wdeprecated-enum-float-conversion -Wenum-float-conversion -Wfinal-dtor-non-final-class -Wformat=2 -Wmisleading-indentation -Wpointer-to-int-cast -Wreorder-init-list -Wundef -Wunused-but-set-variable -Wvla -Werror=unguarded-availability -Wno-elaborated-enum-base -Wcast-qual -Wchar-subscripts -Wextra-tokens -Winit-self -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare -Wimplicit-fallthrough -Wvla -Wno-unknown-warning-option -Wliteral-conversion -Wthread-safety -Wno-profile-instr-out-of-date -Wno-profile-instr-unprofiled -Wno-backend-plugin -Wunsafe-buffer-usage -std=c++2b -fdeprecated-macro -ferror-limit 19 -fmacro-backtrace-limit=0 -fvisibility=hidden -fvisibility-inlines-hidden -stack-protector 1 -fblocks -fencode-extended-block-signature -fno-rtti -fregister-global-dtors-with-atexit -fgnuc-version=4.2.1 -fno-cxx-modules -fno-implicit-modules -fskip-odr-check-in-gmf -fpascal-strings -fmax-type-align=16 -fdiagnostics-show-note-include-stack -vectorize-loops -vectorize-slp -fsafe-buffer-usage-suggestions -analyzer-output=html -analyzer-config report-in-main-source-file=true -analyzer-config nullability:NoDiagnoseCallsToSystemHeaders=true -analyzer-checker optin.osx.cocoa.localizability.NonLocalizedStringChecker -analyzer-checker security.insecureAPI.UncheckedReturn -analyzer-checker security.insecureAPI.getpw -analyzer-checker security.insecureAPI.gets -analyzer-checker security.insecureAPI.mkstemp -analyzer-checker security.insecureAPI.mktemp -analyzer-disable-checker security.insecureAPI.rand -analyzer-disable-checker security.insecureAPI.strcpy -analyzer-checker security.insecureAPI.vfork -analyzer-disable-checker alpha,apiModeling,core,cplusplus,deadcode,debug,fuchsia,nullability,optin,osx,security,unix,webkit -analyzer-checker alpha.webkit.ForwardDeclChecker,alpha.webkit.MemoryUnsafeCastChecker,alpha.webkit.NoDeleteChecker,alpha.webkit.NoUncheckedPtrMemberChecker,alpha.webkit.NoUnretainedMemberChecker,alpha.webkit.RetainPtrCtorAdoptChecker,alpha.webkit.UncheckedCallArgsChecker,alpha.webkit.UncheckedLocalVarsChecker,alpha.webkit.UncountedCallArgsChecker,alpha.webkit.UncountedLocalVarsChecker,alpha.webkit.UnretainedCallArgsChecker,alpha.webkit.UnretainedLambdaCapturesChecker,alpha.webkit.UnretainedLocalVarsChecker,webkit.NoUncountedMemberChecker,webkit.RefCntblBaseVirtualDtor,webkit.UncountedLambdaCapturesChecker -analyzer-config max-nodes=10000000 -analyzer-config verbose-report-filename=true -fdwarf2-cfi-asm -o /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/scan-build-output/StaticAnalyzer/WebCore/WebCore/normal/arm64/UnifiedSource225.plist -x c++ /Volumes/Data/worker/Apple-iOS-26-Safer-CPP-Checks-EWS/build/WebKitBuild/Release-iphonesimulator/DerivedSources/WebCore/unified-sources/UnifiedSource225.cpp
1/*
2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
3 * (C) 1999 Antti Koivisto (koivisto@kde.org)
4 * (C) 2000 Stefan Schimanski (1Stein@gmx.de)
5 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Library General Public
10 * License as published by the Free Software Foundation; either
11 * version 2 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Library General Public License for more details.
17 *
18 * You should have received a copy of the GNU Library General Public License
19 * along with this library; see the file COPYING.LIB. If not, write to
20 * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
21 * Boston, MA 02110-1301, USA.
22 */
23
24#include "config.h"
25#include "HTMLObjectElement.h"
26
27#include "Attribute.h"
28#include "CSSValueKeywords.h"
29#include "CachedImage.h"
30#include "ContainerNodeInlines.h"
31#include "ElementChildIteratorInlines.h"
32#include "FrameLoader.h"
33#include "HTMLDocument.h"
34#include "HTMLFormElement.h"
35#include "HTMLImageLoader.h"
36#include "HTMLMetaElement.h"
37#include "HTMLNames.h"
38#include "HTMLParamElement.h"
39#include "LocalFrame.h"
40#include "MIMETypeRegistry.h"
41#include "NodeList.h"
42#include "NodeInlines.h"
43#include "NodeName.h"
44#include "Page.h"
45#include "RenderEmbeddedObject.h"
46#include "RenderImage.h"
47#include "RenderWidget.h"
48#include "Settings.h"
49#include "SubframeLoader.h"
50#include "Text.h"
51#include "Widget.h"
52#include <wtf/Ref.h>
53#include <wtf/RobinHoodHashSet.h>
54#include <wtf/TZoneMallocInlines.h>
55
56#if PLATFORM(IOS_FAMILY)(defined 1 && 1)
57#include <wtf/RuntimeApplicationChecks.h>
58#endif
59
60namespace WebCore {
61
62WTF_MAKE_TZONE_ALLOCATED_IMPL(HTMLObjectElement)::bmalloc::api::HeapRef HTMLObjectElement::s_heapRef; const TZoneSpecification
HTMLObjectElement::s_heapSpec = { &HTMLObjectElement::s_heapRef
, TZoneSpecification::encodeSize<HTMLObjectElement>(), TZoneSpecification
::encodeAlignment<HTMLObjectElement>(), TZoneSpecification
::encodeCategory<HTMLObjectElement>(), ::bmalloc::api::
compactAllocationMode<HTMLObjectElement>(), TZoneSpecification
::encodeDescriptor<HTMLObjectElement>(), }; void* HTMLObjectElement
::operatorNewSlow(size_t size) { if constexpr (::bmalloc::api
::compactAllocationMode<HTMLObjectElement>() == CompactAllocationMode
::Compact) return ::bmalloc::api::tzoneAllocateCompactSlow(size
, s_heapSpec); return ::bmalloc::api::tzoneAllocateNonCompactSlow
(size, s_heapSpec); } using __makeBtzoneMallocedInlineMacroSemicolonifier
__attribute__((unused)) = int
;
63
64using namespace HTMLNames;
65
66inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document& document, HTMLFormElement* form)
67 : HTMLPlugInElement(tagName, document)
68 , FormListedElement(form)
69{
70 ASSERT(hasTagName(objectTag))((void)0);
71}
72
73Ref<HTMLObjectElement> HTMLObjectElement::create(const QualifiedName& tagName, Document& document, HTMLFormElement* form)
74{
75 return adoptRef(*new HTMLObjectElement(tagName, document, form));
76}
77
78HTMLObjectElement::~HTMLObjectElement()
79{
80 clearForm();
81}
82
83int HTMLObjectElement::defaultTabIndex() const
84{
85 return 0;
86}
87
88bool HTMLObjectElement::hasPresentationalHintsForAttribute(const QualifiedName& name) const
89{
90 if (name == borderAttr)
91 return true;
92 return HTMLPlugInElement::hasPresentationalHintsForAttribute(name);
93}
94
95void HTMLObjectElement::collectPresentationalHintsForAttribute(const QualifiedName& name, const AtomString& value, MutableStyleProperties& style)
96{
97 if (name == borderAttr)
98 applyBorderAttributeToStyle(value, style);
99 else
100 HTMLPlugInElement::collectPresentationalHintsForAttribute(name, value, style);
101}
102
103void HTMLObjectElement::attributeChanged(const QualifiedName& name, const AtomString& oldValue, const AtomString& newValue, AttributeModificationReason attributeModificationReason)
104{
105 HTMLPlugInElement::attributeChanged(name, oldValue, newValue, attributeModificationReason);
106
107 bool invalidateRenderer = false;
108 bool needsWidgetUpdate = false;
109
110 switch (name.nodeName()) {
111 case AttributeNames::typeAttr:
112 m_serviceType = newValue.string().left(newValue.find(';')).convertToASCIILowercase();
113 invalidateRenderer = !hasAttributeWithoutSynchronization(classidAttr);
114 needsWidgetUpdate = true;
115 break;
116 case AttributeNames::dataAttr:
117 // FIXME: trimming whitespace is probably redundant with the URL parser
118 m_url = newValue.string().trim(isASCIIWhitespace);
119 invalidateRenderer = !hasAttributeWithoutSynchronization(classidAttr);
120 needsWidgetUpdate = true;
121 updateImageLoaderWithNewURLSoon();
122 break;
123 case AttributeNames::classidAttr:
124 invalidateRenderer = true;
125 needsWidgetUpdate = true;
126 break;
127 default:
128 FormListedElement::parseAttribute(name, newValue);
129 break;
130 }
131
132 if (needsWidgetUpdate) {
133 setNeedsWidgetUpdate(true);
134 m_useFallbackContent = false;
135 }
136
137 if (!invalidateRenderer || !isConnected() || !renderer())
138 return;
139
140 scheduleUpdateForAfterStyleResolution();
141 invalidateStyleAndRenderersForSubtree();
142}
143
144static void mapDataParamToSrc(Vector<AtomString>& paramNames, Vector<AtomString>& paramValues)
145{
146 // Some plugins don't understand the "data" attribute of the OBJECT tag (i.e. Real and WMP require "src" attribute).
147 bool foundSrcParam = false;
148 AtomString dataParamValue;
149 for (unsigned i = 0; i < paramNames.size(); ++i) {
150 if (equalLettersIgnoringASCIICase(paramNames[i], "src"_s))
151 foundSrcParam = true;
152 else if (equalLettersIgnoringASCIICase(paramNames[i], "data"_s))
153 dataParamValue = paramValues[i];
154 }
155 if (!foundSrcParam && !dataParamValue.isNull()) {
156 paramNames.append(AtomString { "src"_s });
157 paramValues.append(WTF::move(dataParamValue));
158 }
159}
160
161void HTMLObjectElement::parametersForPlugin(Vector<AtomString>& paramNames, Vector<AtomString>& paramValues)
162{
163 if (hasAttributes()) {
164 for (auto& attribute : attributes()) {
165 paramNames.append(attribute.name().localName());
166 paramValues.append(attribute.value());
167 }
168 }
169
170 mapDataParamToSrc(paramNames, paramValues);
171}
172
173bool HTMLObjectElement::hasFallbackContent() const
174{
175 for (RefPtr<Node> child = firstChild(); child; child = child->nextSibling()) {
176 // Ignore whitespace-only text, and <param> tags, any other content is fallback content.
177 if (auto* textChild = dynamicDowncast<Text>(*child)) {
178 if (!textChild->containsOnlyASCIIWhitespace())
179 return true;
180 } else if (!is<HTMLParamElement>(*child))
181 return true;
182 }
183 return false;
184}
185
186// FIXME: This should be unified with HTMLEmbedElement::updateWidget and
187// moved down into HTMLPlugInElement.cpp
188void HTMLObjectElement::updateWidget(CreatePlugins createPlugins)
189{
190 ASSERT(!renderEmbeddedObject()->isPluginUnavailable())((void)0);
191 ASSERT(needsWidgetUpdate())((void)0);
192
193 // FIXME: This should ASSERT isFinishedParsingChildren() instead.
194 if (!isFinishedParsingChildren()) {
195 setNeedsWidgetUpdate(false);
196 return;
197 }
198
199 // FIXME: I'm not sure it's ever possible to get into updateWidget during a
200 // removal, but just in case we should avoid loading the frame to prevent
201 // security bugs.
202 if (!SubframeLoadingDisabler::canLoadFrame(*this)) {
203 setNeedsWidgetUpdate(false);
204 return;
205 }
206
207 // FIXME: These should be joined into a PluginParameters class.
208 Vector<AtomString> paramNames;
209 Vector<AtomString> paramValues;
210 parametersForPlugin(paramNames, paramValues);
211
212 auto url = this->url();
213 if (!canLoadURL(url)) {
214 setNeedsWidgetUpdate(false);
215 return;
216 }
217
218 // FIXME: It's unfortunate that we have this special case here.
219 // See http://trac.webkit.org/changeset/25128 and the plugins/netscape-plugin-setwindow-size.html test.
220 auto serviceType = this->serviceType();
221 if (createPlugins == CreatePlugins::No && wouldLoadAsPlugIn(url, serviceType))
222 return;
223
224 setNeedsWidgetUpdate(false);
225
226 Ref protectedThis = *this; // Plugin loading can make arbitrary DOM mutations.
227
228 // HTML5 says that fallback content should be rendered if a non-empty
229 // classid is specified for which the UA can't find a suitable plug-in.
230 //
231 // Dispatching a beforeLoad event could have executed code that changed the document.
232 // Make sure the URL is still safe to load.
233 bool success = attributeWithoutSynchronization(classidAttr).isEmpty() && canLoadURL(url);
234 if (success)
235 success = requestObject(url, serviceType, paramNames, paramValues);
236 if (!success && hasFallbackContent())
237 renderFallbackContent();
238}
239
240Node::InsertedIntoAncestorResult HTMLObjectElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
241{
242 HTMLPlugInElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
243 FormListedElement::elementInsertedIntoAncestor(*this, insertionType);
244 if (!insertionType.connectedToDocument)
245 return InsertedIntoAncestorResult::Done;
246 return InsertedIntoAncestorResult::NeedsPostInsertionCallback;
247}
248
249void HTMLObjectElement::didFinishInsertingNode()
250{
251 resetFormOwner();
252}
253
254void HTMLObjectElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
255{
256 HTMLPlugInElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
257 FormListedElement::elementRemovedFromAncestor(*this, removalType);
258}
259
260void HTMLObjectElement::childrenChanged(const ChildChange& change)
261{
262 updateExposedState();
263 if (isConnected() && !m_useFallbackContent) {
264 setNeedsWidgetUpdate(true);
265 scheduleUpdateForAfterStyleResolution();
266 invalidateStyleForSubtree();
267 }
268 HTMLPlugInElement::childrenChanged(change);
269}
270
271bool HTMLObjectElement::isURLAttribute(const Attribute& attribute) const
272{
273 return attribute.name() == dataAttr || attribute.name() == codebaseAttr || HTMLPlugInElement::isURLAttribute(attribute);
274}
275
276const AtomString& HTMLObjectElement::imageSourceURL() const
277{
278 return attributeWithoutSynchronization(dataAttr);
279}
280
281void HTMLObjectElement::renderFallbackContent()
282{
283 if (m_useFallbackContent)
284 return;
285
286 if (!isConnected())
287 return;
288
289 scheduleUpdateForAfterStyleResolution();
290 invalidateStyleAndRenderersForSubtree();
291
292 // Presence of a UA shadow root indicates render invalidation during embedded PDF plugin bringup, and not a failed render.
293 // It's safe to special case here because UA shadow root cannot be attached to <object>/<embed> programmatically.
294 if (userAgentShadowRoot())
295 return;
296
297 // Before we give up and use fallback content, check to see if this is a MIME type issue.
298 RefPtr loader = imageLoader();
299 if (loader && loader->image() && loader->image()->status() != CachedResource::LoadError) {
300 m_serviceType = loader->image()->response().mimeType();
Call argument for 'this' parameter is uncounted and unsafe
301 if (!isImageType()) {
302 // If we don't think we have an image type anymore, then clear the image from the loader.
303 loader->clearImage();
304 return;
305 }
306 }
307
308 m_useFallbackContent = true;
309}
310
311static inline bool preventsParentObjectFromExposure(const Element& child)
312{
313 static NeverDestroyed mostKnownTags = [] {
314 MemoryCompactLookupOnlyRobinHoodHashSet<QualifiedName> set;
315 auto tags = HTMLNames::getHTMLTags();
316 set.reserveInitialCapacity(tags.size());
317 for (auto* tagPtr : tags) {
318 auto& tag = *tagPtr;
319 // Only the param element was explicitly mentioned in the HTML specification rule
320 // we were trying to implement, but these are other known HTML elements that we
321 // have decided, over the years, to treat as children that do not prevent object
322 // names from being exposed.
323 if (tag == bgsoundTag
324 || tag == detailsTag
325 || tag == figcaptionTag
326 || tag == figureTag
327 || tag == paramTag
328 || tag == summaryTag
329 || tag == trackTag) {
330 continue;
331 }
332 set.add(tag);
333 }
334 return set;
335 }();
336 return mostKnownTags.get().contains(child.tagQName());
337}
338
339static inline bool preventsParentObjectFromExposure(const Node& child)
340{
341 if (auto* childElement = dynamicDowncast<Element>(child))
342 return preventsParentObjectFromExposure(*childElement);
343 if (auto* childText = dynamicDowncast<Text>(child))
344 return !childText->containsOnlyASCIIWhitespace();
345 return true;
346}
347
348static inline bool shouldBeExposed(const HTMLObjectElement& element)
349{
350 // FIXME: This should be redone to use the concept of an exposed object element,
351 // as documented in the HTML specification section describing DOM tree accessors.
352
353 // The rule we try to implement here, from older HTML specifications, is "object elements
354 // with no children other than param elements, unknown elements and whitespace can be found
355 // by name in a document, and other object elements cannot".
356
357 for (RefPtr child = element.firstChild(); child; child = child->nextSibling()) {
358 if (preventsParentObjectFromExposure(*child))
359 return false;
360 }
361 return true;
362}
363
364void HTMLObjectElement::updateExposedState()
365{
366 bool wasExposed = std::exchange(m_isExposed, shouldBeExposed(*this));
367
368 if (m_isExposed != wasExposed && isConnected() && !isInShadowTree()) {
369 if (RefPtr document = dynamicDowncast<HTMLDocument>(this->document())) {
370 auto& id = getIdAttribute();
371 if (!id.isEmpty()) {
372 if (m_isExposed)
373 document->addDocumentNamedItem(id, *this);
374 else
375 document->removeDocumentNamedItem(id, *this);
376 }
377
378 auto& name = getNameAttribute();
379 if (!name.isEmpty() && id != name) {
380 if (m_isExposed)
381 document->addDocumentNamedItem(name, *this);
382 else
383 document->removeDocumentNamedItem(name, *this);
384 }
385 }
386 }
387}
388
389void HTMLObjectElement::addSubresourceAttributeURLs(ListHashSet<URL>& urls) const
390{
391 HTMLPlugInElement::addSubresourceAttributeURLs(urls);
392
393 addSubresourceURL(urls, protect(document())->completeURL(attributeWithoutSynchronization(dataAttr)));
394}
395
396void HTMLObjectElement::didMoveToNewDocument(Document& oldDocument, Document& newDocument)
397{
398 FormListedElement::didMoveToNewDocument();
399 HTMLPlugInElement::didMoveToNewDocument(oldDocument, newDocument);
400}
401
402bool HTMLObjectElement::canContainRangeEndPoint() const
403{
404 // Call through to HTMLElement because HTMLPlugInElement::canContainRangeEndPoint
405 // returns false unconditionally. An object element using fallback content is
406 // treated like a generic HTML element.
407 return m_useFallbackContent && HTMLElement::canContainRangeEndPoint();
408}
409
410}