- Revision
- 242858
- Author
- [email protected]
- Date
- 2019-03-13 01:24:42 -0700 (Wed, 13 Mar 2019)
Log Message
Cherry-pick r242587. rdar://problem/48839354
Crash when attempting to change input type while dismissing datalist suggestions
https://bugs.webkit.org/show_bug.cgi?id=195384
<rdar://problem/48563718>
Reviewed by Brent Fulgham.
Source/WebCore:
When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
reference its active datalist suggestions picker.
Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
* platform/DataListSuggestionPicker.h:
Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
Source/WebKit:
See WebCore ChangeLog for more details.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::setActiveDataListSuggestionPicker):
(WebKit::WebPage::didSelectDataListOption):
(WebKit::WebPage::didCloseSuggestions):
* WebProcess/WebPage/WebPage.h:
Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
LayoutTests:
Add a new layout test to exercise this scenario.
* fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
* fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242587 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (242857 => 242858)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-13 08:24:38 UTC (rev 242857)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-13 08:24:42 UTC (rev 242858)
@@ -1,5 +1,63 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242587. rdar://problem/48839354
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ Source/WebCore:
+
+ When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
+ active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
+ alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
+ reference its active datalist suggestions picker.
+
+ Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
+
+ * platform/DataListSuggestionPicker.h:
+
+ Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
+ issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
+
+ Source/WebKit:
+
+ See WebCore ChangeLog for more details.
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::setActiveDataListSuggestionPicker):
+ (WebKit::WebPage::didSelectDataListOption):
+ (WebKit::WebPage::didCloseSuggestions):
+ * WebProcess/WebPage/WebPage.h:
+
+ Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
+
+ LayoutTests:
+
+ Add a new layout test to exercise this scenario.
+
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242587 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-06 Wenson Hsieh <[email protected]>
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ Add a new layout test to exercise this scenario.
+
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242515. rdar://problem/48839275
SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
Added: branches/safari-607-branch/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt (0 => 242858)
--- branches/safari-607-branch/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt 2019-03-13 08:24:42 UTC (rev 242858)
@@ -0,0 +1,3 @@
+This test verifies that the type of an input with an associated datalist can be changed immediately after the datalist suggestions menu is closed. To test manually, load this page and check that it does not crash.
+
+
Added: branches/safari-607-branch/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html (0 => 242858)
--- branches/safari-607-branch/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html 2019-03-13 08:24:42 UTC (rev 242858)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <p>This test verifies that the type of an input with an associated datalist can be changed immediately after the datalist suggestions menu is closed. To test manually, load this page and check that it does not crash.</p>
+ <input value="a" id="input" list="datalist">
+ <datalist id="datalist">
+ <option>a</option>
+ </datalist>
+</body>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ input.select();
+ document.execCommand("Delete");
+ input.type = "button";
+</script>
+</html>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (242857 => 242858)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-13 08:24:38 UTC (rev 242857)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-13 08:24:42 UTC (rev 242858)
@@ -1,5 +1,70 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242587. rdar://problem/48839354
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ Source/WebCore:
+
+ When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
+ active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
+ alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
+ reference its active datalist suggestions picker.
+
+ Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
+
+ * platform/DataListSuggestionPicker.h:
+
+ Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
+ issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
+
+ Source/WebKit:
+
+ See WebCore ChangeLog for more details.
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::setActiveDataListSuggestionPicker):
+ (WebKit::WebPage::didSelectDataListOption):
+ (WebKit::WebPage::didCloseSuggestions):
+ * WebProcess/WebPage/WebPage.h:
+
+ Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
+
+ LayoutTests:
+
+ Add a new layout test to exercise this scenario.
+
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242587 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-06 Wenson Hsieh <[email protected]>
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
+ active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
+ alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
+ reference its active datalist suggestions picker.
+
+ Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
+
+ * platform/DataListSuggestionPicker.h:
+
+ Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
+ issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242515. rdar://problem/48839275
SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
Modified: branches/safari-607-branch/Source/WebCore/platform/DataListSuggestionPicker.h (242857 => 242858)
--- branches/safari-607-branch/Source/WebCore/platform/DataListSuggestionPicker.h 2019-03-13 08:24:38 UTC (rev 242857)
+++ branches/safari-607-branch/Source/WebCore/platform/DataListSuggestionPicker.h 2019-03-13 08:24:42 UTC (rev 242858)
@@ -27,14 +27,13 @@
#if ENABLE(DATALIST_ELEMENT)
-#import "DataListSuggestionInformation.h"
-#import "IntRect.h"
+#include "DataListSuggestionInformation.h"
+#include <wtf/WeakPtr.h>
+#include <wtf/text/WTFString.h>
-#import <wtf/text/WTFString.h>
-
namespace WebCore {
-class DataListSuggestionPicker {
+class DataListSuggestionPicker : public CanMakeWeakPtr<DataListSuggestionPicker> {
public:
virtual ~DataListSuggestionPicker() = default;
Modified: branches/safari-607-branch/Source/WebKit/ChangeLog (242857 => 242858)
--- branches/safari-607-branch/Source/WebKit/ChangeLog 2019-03-13 08:24:38 UTC (rev 242857)
+++ branches/safari-607-branch/Source/WebKit/ChangeLog 2019-03-13 08:24:42 UTC (rev 242858)
@@ -1,5 +1,68 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242587. rdar://problem/48839354
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ Source/WebCore:
+
+ When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
+ active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
+ alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
+ reference its active datalist suggestions picker.
+
+ Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
+
+ * platform/DataListSuggestionPicker.h:
+
+ Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
+ issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
+
+ Source/WebKit:
+
+ See WebCore ChangeLog for more details.
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::setActiveDataListSuggestionPicker):
+ (WebKit::WebPage::didSelectDataListOption):
+ (WebKit::WebPage::didCloseSuggestions):
+ * WebProcess/WebPage/WebPage.h:
+
+ Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
+
+ LayoutTests:
+
+ Add a new layout test to exercise this scenario.
+
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242587 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-06 Wenson Hsieh <[email protected]>
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ See WebCore ChangeLog for more details.
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::setActiveDataListSuggestionPicker):
+ (WebKit::WebPage::didSelectDataListOption):
+ (WebKit::WebPage::didCloseSuggestions):
+ * WebProcess/WebPage/WebPage.h:
+
+ Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r241452. rdar://problem/48839390
Make WebRTCUnifiedPlanEnabled true by default
Modified: branches/safari-607-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp (242857 => 242858)
--- branches/safari-607-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2019-03-13 08:24:38 UTC (rev 242857)
+++ branches/safari-607-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2019-03-13 08:24:42 UTC (rev 242858)
@@ -3862,19 +3862,19 @@
void WebPage::setActiveDataListSuggestionPicker(WebDataListSuggestionPicker* dataListSuggestionPicker)
{
- m_activeDataListSuggestionPicker = dataListSuggestionPicker;
+ m_activeDataListSuggestionPicker = makeWeakPtr(dataListSuggestionPicker);
}
void WebPage::didSelectDataListOption(const String& selectedOption)
{
- m_activeDataListSuggestionPicker->didSelectOption(selectedOption);
+ if (m_activeDataListSuggestionPicker)
+ m_activeDataListSuggestionPicker->didSelectOption(selectedOption);
}
void WebPage::didCloseSuggestions()
{
- if (m_activeDataListSuggestionPicker)
- m_activeDataListSuggestionPicker->didCloseSuggestions();
- m_activeDataListSuggestionPicker = nullptr;
+ if (auto picker = std::exchange(m_activeDataListSuggestionPicker, nullptr))
+ picker->didCloseSuggestions();
}
#endif
Modified: branches/safari-607-branch/Source/WebKit/WebProcess/WebPage/WebPage.h (242857 => 242858)
--- branches/safari-607-branch/Source/WebKit/WebProcess/WebPage/WebPage.h 2019-03-13 08:24:38 UTC (rev 242857)
+++ branches/safari-607-branch/Source/WebKit/WebProcess/WebPage/WebPage.h 2019-03-13 08:24:42 UTC (rev 242858)
@@ -1630,7 +1630,7 @@
#endif
#if ENABLE(DATALIST_ELEMENT)
- WebDataListSuggestionPicker* m_activeDataListSuggestionPicker { nullptr };
+ WeakPtr<WebDataListSuggestionPicker> m_activeDataListSuggestionPicker;
#endif
RefPtr<WebOpenPanelResultListener> m_activeOpenPanelResultListener;
