Title: [223028] trunk
- Revision
- 223028
- Author
- [email protected]
- Date
- 2017-10-08 00:47:43 -0700 (Sun, 08 Oct 2017)
Log Message
Nullptr deref in WebCore::Node::computeEditability
https://bugs.webkit.org/show_bug.cgi?id=177905
<rdar://problem/34138402>
Reviewed by Darin Adler.
Source/WebCore:
Script can run when setting focus, because a blur event and a focus event are generated.
A handler for one of these events can cause the focused element to be cleared. We should
handle this possibility gracefully.
Test: fast/dom/focus-shift-crash.html
* dom/Document.cpp:
(WebCore::Document::setFocusedElement):
LayoutTests:
* fast/dom/focus-shift-crash-expected.txt: Added.
* fast/dom/focus-shift-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (223027 => 223028)
--- trunk/LayoutTests/ChangeLog 2017-10-08 03:15:56 UTC (rev 223027)
+++ trunk/LayoutTests/ChangeLog 2017-10-08 07:47:43 UTC (rev 223028)
@@ -1,3 +1,14 @@
+2017-10-08 Brent Fulgham <[email protected]>
+
+ Nullptr deref in WebCore::Node::computeEditability
+ https://bugs.webkit.org/show_bug.cgi?id=177905
+ <rdar://problem/34138402>
+
+ Reviewed by Darin Adler.
+
+ * fast/dom/focus-shift-crash-expected.txt: Added.
+ * fast/dom/focus-shift-crash.html: Added.
+
2017-10-07 Andy Estes <[email protected]>
[Payment Request] Implement PaymentRequest.show() and PaymentRequest.hide()
Added: trunk/LayoutTests/fast/dom/focus-shift-crash-expected.txt (0 => 223028)
--- trunk/LayoutTests/fast/dom/focus-shift-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/focus-shift-crash-expected.txt 2017-10-08 07:47:43 UTC (rev 223028)
@@ -0,0 +1 @@
+The test passes if it does not crash or assert in debug mode.
Added: trunk/LayoutTests/fast/dom/focus-shift-crash.html (0 => 223028)
--- trunk/LayoutTests/fast/dom/focus-shift-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/focus-shift-crash.html 2017-10-08 07:47:43 UTC (rev 223028)
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+function blurHandler() {
+ var body = document.getElementById("testBody");
+ var frame = document.getElementById("testFrame");
+ body.appendChild(frame);
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+
+function audioHandler() {
+ var frameSet = document.createElement("frameset");
+ frameSet.setAttribute("onblur", "blurHandler()");
+
+ var frame = document.getElementById("testFrame");
+ frame.focus();
+}
+</script>
+</head>
+<body id="testBody">
+ The test passes if it does not crash or assert in debug mode.
+ <audio src="" _onloadstart_="audioHandler()"></audio>
+ <iframe id="testFrame" srcdoc="test"></iframe>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (223027 => 223028)
--- trunk/Source/WebCore/ChangeLog 2017-10-08 03:15:56 UTC (rev 223027)
+++ trunk/Source/WebCore/ChangeLog 2017-10-08 07:47:43 UTC (rev 223028)
@@ -1,3 +1,20 @@
+2017-10-08 Brent Fulgham <[email protected]>
+
+ Nullptr deref in WebCore::Node::computeEditability
+ https://bugs.webkit.org/show_bug.cgi?id=177905
+ <rdar://problem/34138402>
+
+ Reviewed by Darin Adler.
+
+ Script can run when setting focus, because a blur event and a focus event are generated.
+ A handler for one of these events can cause the focused element to be cleared. We should
+ handle this possibility gracefully.
+
+ Test: fast/dom/focus-shift-crash.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::setFocusedElement):
+
2017-10-07 Darin Adler <[email protected]>
Update Document.createEvent for recent DOM specification changes
Modified: trunk/Source/WebCore/dom/Document.cpp (223027 => 223028)
--- trunk/Source/WebCore/dom/Document.cpp 2017-10-08 03:15:56 UTC (rev 223027)
+++ trunk/Source/WebCore/dom/Document.cpp 2017-10-08 07:47:43 UTC (rev 223028)
@@ -3863,6 +3863,13 @@
m_focusedElement->setFocus(true);
+ // The setFocus call triggers a blur and a focus event. Event handlers could cause the focused element to be cleared.
+ if (m_focusedElement != newFocusedElement) {
+ // handler shifted focus
+ focusChangeBlocked = true;
+ goto SetFocusedNodeDone;
+ }
+
if (m_focusedElement->isRootEditableElement())
frame()->editor().didBeginEditing();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
