Title: [239019] trunk/Source/WebKit
Revision
239019
Author
[email protected]
Date
2018-12-09 01:05:45 -0800 (Sun, 09 Dec 2018)

Log Message

[iOS device] Crash when attempting to call -[_WKAttachment info] for an editable image
https://bugs.webkit.org/show_bug.cgi?id=192538

Reviewed by Tim Horton.

Fix the crash by ensuring that the result of `-renderedDrawing` survives long enough to be wrapped by a
`RetainPtr` in `-PNGRepresentation`. This isn't currently testable, since this codepath isn't supported on the
iOS simulator; instead, I manually verified using MobileAttachments.app.

* UIProcess/ios/WKDrawingView.mm:
(-[WKDrawingView renderedDrawing]):

Modified Paths

Diff

Modified: trunk/Source/WebKit/ChangeLog (239018 => 239019)


--- trunk/Source/WebKit/ChangeLog	2018-12-09 08:00:32 UTC (rev 239018)
+++ trunk/Source/WebKit/ChangeLog	2018-12-09 09:05:45 UTC (rev 239019)
@@ -1,3 +1,17 @@
+2018-12-09  Wenson Hsieh  <[email protected]>
+
+        [iOS device] Crash when attempting to call -[_WKAttachment info] for an editable image
+        https://bugs.webkit.org/show_bug.cgi?id=192538
+
+        Reviewed by Tim Horton.
+
+        Fix the crash by ensuring that the result of `-renderedDrawing` survives long enough to be wrapped by a
+        `RetainPtr` in `-PNGRepresentation`. This isn't currently testable, since this codepath isn't supported on the
+        iOS simulator; instead, I manually verified using MobileAttachments.app.
+
+        * UIProcess/ios/WKDrawingView.mm:
+        (-[WKDrawingView renderedDrawing]):
+
 2018-12-09  Commit Queue  <[email protected]>
 
         Unreviewed, rolling out r239010.

Modified: trunk/Source/WebKit/UIProcess/ios/WKDrawingView.mm (239018 => 239019)


--- trunk/Source/WebKit/UIProcess/ios/WKDrawingView.mm	2018-12-09 08:00:32 UTC (rev 239018)
+++ trunk/Source/WebKit/UIProcess/ios/WKDrawingView.mm	2018-12-09 09:05:45 UTC (rev 239019)
@@ -120,7 +120,7 @@
     // an NSFileWrapper to be available synchronously.
     dispatch_sync(_renderQueue.get(), ^{ });
 
-    return resultImage.get();
+    return resultImage.autorelease();
 #endif
 }
 
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to