Title: [218537] releases/WebKitGTK/webkit-2.16
- Revision
- 218537
- Author
- [email protected]
- Date
- 2017-06-19 23:23:34 -0700 (Mon, 19 Jun 2017)
Log Message
Merge r217439 - Crash on WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance + 1195
https://bugs.webkit.org/show_bug.cgi?id=172555
<rdar://problem/32004724>
Reviewed by Ryosuke Niwa.
Source/WebCore:
setSelectionWithoutUpdatingAppearance could dispatch a synchronous focusin event,
which could invoke an event handler that deteles the frame. Therefore, add a
protector before the call.
Test: editing/selection/select-iframe-focusin-document-crash.html
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::setSelection):
LayoutTests:
* editing/selection/resources/select-iframe-focusin-document-crash-frame.html: Added.
* editing/selection/select-iframe-focusin-document-crash-expected.txt: Added.
* editing/selection/select-iframe-focusin-document-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog (218536 => 218537)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-06-20 06:14:07 UTC (rev 218536)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-06-20 06:23:34 UTC (rev 218537)
@@ -1,3 +1,15 @@
+2017-05-24 Jiewen Tan <[email protected]>
+
+ Crash on WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance + 1195
+ https://bugs.webkit.org/show_bug.cgi?id=172555
+ <rdar://problem/32004724>
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/selection/resources/select-iframe-focusin-document-crash-frame.html: Added.
+ * editing/selection/select-iframe-focusin-document-crash-expected.txt: Added.
+ * editing/selection/select-iframe-focusin-document-crash.html: Added.
+
2017-03-24 Brent Fulgham <[email protected]>
Handle recursive calls to ProcessingInstruction::checkStyleSheet
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/resources/select-iframe-focusin-document-crash-frame.html (0 => 218537)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/resources/select-iframe-focusin-document-crash-frame.html (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/resources/select-iframe-focusin-document-crash-frame.html 2017-06-20 06:23:34 UTC (rev 218537)
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ </head>
+ <body>
+ <input id='input'></input>
+ </body>
+</html>
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/select-iframe-focusin-document-crash-expected.txt (0 => 218537)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/select-iframe-focusin-document-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/select-iframe-focusin-document-crash-expected.txt 2017-06-20 06:23:34 UTC (rev 218537)
@@ -0,0 +1 @@
+Test passes if WebKit doesn't crash.
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/select-iframe-focusin-document-crash.html (0 => 218537)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/select-iframe-focusin-document-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/select-iframe-focusin-document-crash.html 2017-06-20 06:23:34 UTC (rev 218537)
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ function testcase()
+ {
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+ document.designMode = 'on';
+ setTimeout(run, 0);
+ }
+ function run()
+ {
+ var iframe = document.getElementById("iframe");
+ window.addEventListener('focusin', eventHandle);
+ var element = iframe.contentWindow.document.getElementById("input");
+ element.value = 'demo';
+ element.selectionStart = 0;
+ }
+ function eventHandle(event)
+ {
+ body.innerText = "Test passes if WebKit doesn't crash.";
+ setTimeout(finish, 0);
+ }
+ function finish()
+ {
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+ </script>
+ </head>
+ <body _onload_='testcase();' id='body' >
+ <iframe id='iframe' src=''></iframe>
+ </body>
+</html>
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog (218536 => 218537)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-06-20 06:14:07 UTC (rev 218536)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-06-20 06:23:34 UTC (rev 218537)
@@ -1,3 +1,20 @@
+2017-05-24 Jiewen Tan <[email protected]>
+
+ Crash on WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance + 1195
+ https://bugs.webkit.org/show_bug.cgi?id=172555
+ <rdar://problem/32004724>
+
+ Reviewed by Ryosuke Niwa.
+
+ setSelectionWithoutUpdatingAppearance could dispatch a synchronous focusin event,
+ which could invoke an event handler that deteles the frame. Therefore, add a
+ protector before the call.
+
+ Test: editing/selection/select-iframe-focusin-document-crash.html
+
+ * editing/FrameSelection.cpp:
+ (WebCore::FrameSelection::setSelection):
+
2017-05-23 Zalan Bujtas <[email protected]>
ASSERTION FAILED: !renderer().view().needsLayout() while running media/video-main-content-autoplay.html
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/FrameSelection.cpp (218536 => 218537)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/FrameSelection.cpp 2017-06-20 06:14:07 UTC (rev 218536)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/FrameSelection.cpp 2017-06-20 06:23:34 UTC (rev 218537)
@@ -332,6 +332,7 @@
void FrameSelection::setSelection(const VisibleSelection& selection, SetSelectionOptions options, AXTextStateChangeIntent intent, CursorAlignOnScroll align, TextGranularity granularity)
{
+ RefPtr<Frame> protectedFrame(m_frame);
if (!setSelectionWithoutUpdatingAppearance(selection, options, align, granularity))
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
