Title: [242867] releases/WebKitGTK/webkit-2.24
- Revision
- 242867
- Author
- [email protected]
- Date
- 2019-03-13 02:25:02 -0700 (Wed, 13 Mar 2019)
Log Message
Merge r242587 - Crash when attempting to change input type while dismissing datalist suggestions
https://bugs.webkit.org/show_bug.cgi?id=195384
<rdar://problem/48563718>
Reviewed by Brent Fulgham.
Source/WebCore:
When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
reference its active datalist suggestions picker.
Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
* platform/DataListSuggestionPicker.h:
Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
Source/WebKit:
See WebCore ChangeLog for more details.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::setActiveDataListSuggestionPicker):
(WebKit::WebPage::didSelectDataListOption):
(WebKit::WebPage::didCloseSuggestions):
* WebProcess/WebPage/WebPage.h:
Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
LayoutTests:
Add a new layout test to exercise this scenario.
* fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
* fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog (242866 => 242867)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog 2019-03-13 09:24:56 UTC (rev 242866)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog 2019-03-13 09:25:02 UTC (rev 242867)
@@ -1,3 +1,16 @@
+2019-03-06 Wenson Hsieh <[email protected]>
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ Add a new layout test to exercise this scenario.
+
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
+ * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
+
2019-03-02 Darin Adler <[email protected]>
Retire legacy dtoa function and DecimalNumber class
Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt (0 => 242867)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt 2019-03-13 09:25:02 UTC (rev 242867)
@@ -0,0 +1,3 @@
+This test verifies that the type of an input with an associated datalist can be changed immediately after the datalist suggestions menu is closed. To test manually, load this page and check that it does not crash.
+
+
Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html (0 => 242867)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html 2019-03-13 09:25:02 UTC (rev 242867)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <p>This test verifies that the type of an input with an associated datalist can be changed immediately after the datalist suggestions menu is closed. To test manually, load this page and check that it does not crash.</p>
+ <input value="a" id="input" list="datalist">
+ <datalist id="datalist">
+ <option>a</option>
+ </datalist>
+</body>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ input.select();
+ document.execCommand("Delete");
+ input.type = "button";
+</script>
+</html>
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog (242866 => 242867)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-03-13 09:24:56 UTC (rev 242866)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-03-13 09:25:02 UTC (rev 242867)
@@ -1,3 +1,23 @@
+2019-03-06 Wenson Hsieh <[email protected]>
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
+ active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
+ alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
+ reference its active datalist suggestions picker.
+
+ Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
+
+ * platform/DataListSuggestionPicker.h:
+
+ Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
+ issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
+
2019-03-02 Darin Adler <[email protected]>
Retire legacy dtoa function and DecimalNumber class
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/platform/DataListSuggestionPicker.h (242866 => 242867)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/platform/DataListSuggestionPicker.h 2019-03-13 09:24:56 UTC (rev 242866)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/platform/DataListSuggestionPicker.h 2019-03-13 09:25:02 UTC (rev 242867)
@@ -27,14 +27,13 @@
#if ENABLE(DATALIST_ELEMENT)
-#import "DataListSuggestionInformation.h"
-#import "IntRect.h"
+#include "DataListSuggestionInformation.h"
+#include <wtf/WeakPtr.h>
+#include <wtf/text/WTFString.h>
-#import <wtf/text/WTFString.h>
-
namespace WebCore {
-class DataListSuggestionPicker {
+class DataListSuggestionPicker : public CanMakeWeakPtr<DataListSuggestionPicker> {
WTF_MAKE_FAST_ALLOCATED;
public:
virtual ~DataListSuggestionPicker() = default;
Modified: releases/WebKitGTK/webkit-2.24/Source/WebKit/ChangeLog (242866 => 242867)
--- releases/WebKitGTK/webkit-2.24/Source/WebKit/ChangeLog 2019-03-13 09:24:56 UTC (rev 242866)
+++ releases/WebKitGTK/webkit-2.24/Source/WebKit/ChangeLog 2019-03-13 09:25:02 UTC (rev 242867)
@@ -1,3 +1,21 @@
+2019-03-06 Wenson Hsieh <[email protected]>
+
+ Crash when attempting to change input type while dismissing datalist suggestions
+ https://bugs.webkit.org/show_bug.cgi?id=195384
+ <rdar://problem/48563718>
+
+ Reviewed by Brent Fulgham.
+
+ See WebCore ChangeLog for more details.
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::setActiveDataListSuggestionPicker):
+ (WebKit::WebPage::didSelectDataListOption):
+ (WebKit::WebPage::didCloseSuggestions):
+ * WebProcess/WebPage/WebPage.h:
+
+ Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
+
2019-03-06 Carlos Garcia Campos <[email protected]>
Unreviewed. Update OptionsGTK.cmake and NEWS for 2.23.92 release
Modified: releases/WebKitGTK/webkit-2.24/Source/WebKit/WebProcess/WebPage/WebPage.cpp (242866 => 242867)
--- releases/WebKitGTK/webkit-2.24/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2019-03-13 09:24:56 UTC (rev 242866)
+++ releases/WebKitGTK/webkit-2.24/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2019-03-13 09:25:02 UTC (rev 242867)
@@ -3882,19 +3882,19 @@
void WebPage::setActiveDataListSuggestionPicker(WebDataListSuggestionPicker* dataListSuggestionPicker)
{
- m_activeDataListSuggestionPicker = dataListSuggestionPicker;
+ m_activeDataListSuggestionPicker = makeWeakPtr(dataListSuggestionPicker);
}
void WebPage::didSelectDataListOption(const String& selectedOption)
{
- m_activeDataListSuggestionPicker->didSelectOption(selectedOption);
+ if (m_activeDataListSuggestionPicker)
+ m_activeDataListSuggestionPicker->didSelectOption(selectedOption);
}
void WebPage::didCloseSuggestions()
{
- if (m_activeDataListSuggestionPicker)
- m_activeDataListSuggestionPicker->didCloseSuggestions();
- m_activeDataListSuggestionPicker = nullptr;
+ if (auto picker = std::exchange(m_activeDataListSuggestionPicker, nullptr))
+ picker->didCloseSuggestions();
}
#endif
Modified: releases/WebKitGTK/webkit-2.24/Source/WebKit/WebProcess/WebPage/WebPage.h (242866 => 242867)
--- releases/WebKitGTK/webkit-2.24/Source/WebKit/WebProcess/WebPage/WebPage.h 2019-03-13 09:24:56 UTC (rev 242866)
+++ releases/WebKitGTK/webkit-2.24/Source/WebKit/WebProcess/WebPage/WebPage.h 2019-03-13 09:25:02 UTC (rev 242867)
@@ -1656,7 +1656,7 @@
#endif
#if ENABLE(DATALIST_ELEMENT)
- WebDataListSuggestionPicker* m_activeDataListSuggestionPicker { nullptr };
+ WeakPtr<WebDataListSuggestionPicker> m_activeDataListSuggestionPicker;
#endif
RefPtr<WebOpenPanelResultListener> m_activeOpenPanelResultListener;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
