Title: [243249] trunk/Source/WebCore
- Revision
- 243249
- Author
- [email protected]
- Date
- 2019-03-20 15:49:44 -0700 (Wed, 20 Mar 2019)
Log Message
[iOS] Crash in WebCore::Node::renderRect
https://bugs.webkit.org/show_bug.cgi?id=196035
<rdar://problem/49076783>
Reviewed by Antoine Quint.
When renderRect was called on an HTMLAreaElement, it would
ASSERT because it doesn't have a renderer. We hadn't noticed
this before because none of our tests were hitting this in
debug mode.
The fix is to ask the corresponding HTMLImageElement for
its renderer, and use that for the returned rectangle.
Covered by these tests that had become flakey:
fast/images/imagemap-in-shadow-tree.html
http/tests/download/area-download.html
* dom/Node.cpp:
(WebCore::Node::renderRect):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (243248 => 243249)
--- trunk/Source/WebCore/ChangeLog 2019-03-20 22:48:04 UTC (rev 243248)
+++ trunk/Source/WebCore/ChangeLog 2019-03-20 22:49:44 UTC (rev 243249)
@@ -1,3 +1,26 @@
+2019-03-20 Dean Jackson <[email protected]>
+
+ [iOS] Crash in WebCore::Node::renderRect
+ https://bugs.webkit.org/show_bug.cgi?id=196035
+ <rdar://problem/49076783>
+
+ Reviewed by Antoine Quint.
+
+ When renderRect was called on an HTMLAreaElement, it would
+ ASSERT because it doesn't have a renderer. We hadn't noticed
+ this before because none of our tests were hitting this in
+ debug mode.
+
+ The fix is to ask the corresponding HTMLImageElement for
+ its renderer, and use that for the returned rectangle.
+
+ Covered by these tests that had become flakey:
+ fast/images/imagemap-in-shadow-tree.html
+ http/tests/download/area-download.html
+
+ * dom/Node.cpp:
+ (WebCore::Node::renderRect):
+
2019-03-20 Youenn Fablet <[email protected]>
Have smaller default quotas for third party frames
Modified: trunk/Source/WebCore/dom/Node.cpp (243248 => 243249)
--- trunk/Source/WebCore/dom/Node.cpp 2019-03-20 22:48:04 UTC (rev 243248)
+++ trunk/Source/WebCore/dom/Node.cpp 2019-03-20 22:49:44 UTC (rev 243249)
@@ -42,6 +42,7 @@
#include "EventDispatcher.h"
#include "EventHandler.h"
#include "FrameView.h"
+#include "HTMLAreaElement.h"
#include "HTMLBodyElement.h"
#include "HTMLCollection.h"
#include "HTMLElement.h"
@@ -795,7 +796,11 @@
LayoutRect Node::renderRect(bool* isReplaced)
{
RenderObject* hitRenderer = this->renderer();
- ASSERT(hitRenderer);
+ if (!hitRenderer && is<HTMLAreaElement>(*this)) {
+ auto& area = downcast<HTMLAreaElement>(*this);
+ if (auto* imageElement = area.imageElement())
+ hitRenderer = imageElement->renderer();
+ }
RenderObject* renderer = hitRenderer;
while (renderer && !renderer->isBody() && !renderer->isDocumentElementRenderer()) {
if (renderer->isRenderBlock() || renderer->isInlineBlockOrInlineTable() || renderer->isReplaced()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
