- Revision
- 243724
- Author
- [email protected]
- Date
- 2019-04-01 16:54:18 -0700 (Mon, 01 Apr 2019)
Log Message
Cherry-pick r243684. rdar://problem/49454962
[iOS] Crash when changing inputmode for certain types of focusable elements
https://bugs.webkit.org/show_bug.cgi?id=196431
<rdar://problem/49454962>
Reviewed by Tim Horton.
Source/WebKit:
The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
is only set for certain types of elements that require user input (e.g. text fields, editable content, select
menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
focused element doesn't fall into one of the aforementioned categories.
To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
element. See below for more details.
Test: fast/forms/change-inputmode-crash.html
* WebProcess/WebPage/WebPage.cpp:
(WebKit::isTextFormControlOrEditableContent):
Clean up some existing logic by introducing a helper method for determining whether an element should
propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
of checking against the tag name.
(WebKit::WebPage::elementDidFocus):
(WebKit::WebPage::focusedElementDidChangeInputMode):
LayoutTests:
Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
* fast/forms/change-inputmode-crash-expected.txt: Added.
* fast/forms/change-inputmode-crash.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: tags/Safari-608.1.13.4/LayoutTests/ChangeLog (243723 => 243724)
--- tags/Safari-608.1.13.4/LayoutTests/ChangeLog 2019-04-01 23:54:14 UTC (rev 243723)
+++ tags/Safari-608.1.13.4/LayoutTests/ChangeLog 2019-04-01 23:54:18 UTC (rev 243724)
@@ -1,5 +1,61 @@
2019-04-01 Alan Coon <[email protected]>
+ Cherry-pick r243684. rdar://problem/49454962
+
+ [iOS] Crash when changing inputmode for certain types of focusable elements
+ https://bugs.webkit.org/show_bug.cgi?id=196431
+ <rdar://problem/49454962>
+
+ Reviewed by Tim Horton.
+
+ Source/WebKit:
+
+ The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
+ element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
+ is only set for certain types of elements that require user input (e.g. text fields, editable content, select
+ menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
+ focused element doesn't fall into one of the aforementioned categories.
+
+ To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
+ element. See below for more details.
+
+ Test: fast/forms/change-inputmode-crash.html
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::isTextFormControlOrEditableContent):
+
+ Clean up some existing logic by introducing a helper method for determining whether an element should
+ propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
+ of checking against the tag name.
+
+ (WebKit::WebPage::elementDidFocus):
+ (WebKit::WebPage::focusedElementDidChangeInputMode):
+
+ LayoutTests:
+
+ Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
+
+ * fast/forms/change-inputmode-crash-expected.txt: Added.
+ * fast/forms/change-inputmode-crash.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-31 Wenson Hsieh <[email protected]>
+
+ [iOS] Crash when changing inputmode for certain types of focusable elements
+ https://bugs.webkit.org/show_bug.cgi?id=196431
+ <rdar://problem/49454962>
+
+ Reviewed by Tim Horton.
+
+ Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
+
+ * fast/forms/change-inputmode-crash-expected.txt: Added.
+ * fast/forms/change-inputmode-crash.html: Added.
+
+2019-04-01 Alan Coon <[email protected]>
+
Cherry-pick r243671. rdar://problem/47859936
Move WebResourceLoadStatisticsStore IPC calls from the UI process to the network process
Added: tags/Safari-608.1.13.4/LayoutTests/fast/forms/change-inputmode-crash-expected.txt (0 => 243724)
--- tags/Safari-608.1.13.4/LayoutTests/fast/forms/change-inputmode-crash-expected.txt (rev 0)
+++ tags/Safari-608.1.13.4/LayoutTests/fast/forms/change-inputmode-crash-expected.txt 2019-04-01 23:54:18 UTC (rev 243724)
@@ -0,0 +1,10 @@
+This test verifies that changing the inputmode attribute after changing focus does not cause a crash. To manually run the test, load the page and verify that a crash does not occur.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.activeElement is target
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: tags/Safari-608.1.13.4/LayoutTests/fast/forms/change-inputmode-crash.html (0 => 243724)
--- tags/Safari-608.1.13.4/LayoutTests/fast/forms/change-inputmode-crash.html (rev 0)
+++ tags/Safari-608.1.13.4/LayoutTests/fast/forms/change-inputmode-crash.html 2019-04-01 23:54:18 UTC (rev 243724)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<span id="target" tabindex="0" style="width: 100px; height: 100px;"></span>
+<script>
+description("This test verifies that changing the inputmode attribute after changing focus does not cause a crash. To manually run the test, load the page and verify that a crash does not occur.");
+
+target = document.getElementById("target");
+target.focus();
+target.setAttribute("inputmode", "url");
+shouldBe("document.activeElement", "target");
+</script>
+</body>
+</html>
Modified: tags/Safari-608.1.13.4/Source/WebKit/ChangeLog (243723 => 243724)
--- tags/Safari-608.1.13.4/Source/WebKit/ChangeLog 2019-04-01 23:54:14 UTC (rev 243723)
+++ tags/Safari-608.1.13.4/Source/WebKit/ChangeLog 2019-04-01 23:54:18 UTC (rev 243724)
@@ -1,5 +1,77 @@
2019-04-01 Alan Coon <[email protected]>
+ Cherry-pick r243684. rdar://problem/49454962
+
+ [iOS] Crash when changing inputmode for certain types of focusable elements
+ https://bugs.webkit.org/show_bug.cgi?id=196431
+ <rdar://problem/49454962>
+
+ Reviewed by Tim Horton.
+
+ Source/WebKit:
+
+ The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
+ element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
+ is only set for certain types of elements that require user input (e.g. text fields, editable content, select
+ menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
+ focused element doesn't fall into one of the aforementioned categories.
+
+ To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
+ element. See below for more details.
+
+ Test: fast/forms/change-inputmode-crash.html
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::isTextFormControlOrEditableContent):
+
+ Clean up some existing logic by introducing a helper method for determining whether an element should
+ propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
+ of checking against the tag name.
+
+ (WebKit::WebPage::elementDidFocus):
+ (WebKit::WebPage::focusedElementDidChangeInputMode):
+
+ LayoutTests:
+
+ Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
+
+ * fast/forms/change-inputmode-crash-expected.txt: Added.
+ * fast/forms/change-inputmode-crash.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-31 Wenson Hsieh <[email protected]>
+
+ [iOS] Crash when changing inputmode for certain types of focusable elements
+ https://bugs.webkit.org/show_bug.cgi?id=196431
+ <rdar://problem/49454962>
+
+ Reviewed by Tim Horton.
+
+ The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
+ element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
+ is only set for certain types of elements that require user input (e.g. text fields, editable content, select
+ menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
+ focused element doesn't fall into one of the aforementioned categories.
+
+ To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
+ element. See below for more details.
+
+ Test: fast/forms/change-inputmode-crash.html
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::isTextFormControlOrEditableContent):
+
+ Clean up some existing logic by introducing a helper method for determining whether an element should
+ propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
+ of checking against the tag name.
+
+ (WebKit::WebPage::elementDidFocus):
+ (WebKit::WebPage::focusedElementDidChangeInputMode):
+
+2019-04-01 Alan Coon <[email protected]>
+
Cherry-pick r243671. rdar://problem/47859936
Move WebResourceLoadStatisticsStore IPC calls from the UI process to the network process
Modified: tags/Safari-608.1.13.4/Source/WebKit/WebProcess/WebPage/WebPage.cpp (243723 => 243724)
--- tags/Safari-608.1.13.4/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2019-04-01 23:54:14 UTC (rev 243723)
+++ tags/Safari-608.1.13.4/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2019-04-01 23:54:18 UTC (rev 243724)
@@ -173,7 +173,9 @@
#include <WebCore/HTMLOListElement.h>
#include <WebCore/HTMLPlugInElement.h>
#include <WebCore/HTMLPlugInImageElement.h>
+#include <WebCore/HTMLSelectElement.h>
#include <WebCore/HTMLTextAreaElement.h>
+#include <WebCore/HTMLTextFormControlElement.h>
#include <WebCore/HTMLUListElement.h>
#include <WebCore/HistoryController.h>
#include <WebCore/HistoryItem.h>
@@ -5345,6 +5347,11 @@
return true;
}
+static bool isTextFormControlOrEditableContent(const WebCore::Element& element)
+{
+ return is<HTMLTextFormControlElement>(element) || element.hasEditableStyle();
+}
+
void WebPage::elementDidFocus(WebCore::Element& element)
{
if (!shouldDispatchUpdateAfterFocusingElement(element)) {
@@ -5353,7 +5360,7 @@
return;
}
- if (element.hasTagName(WebCore::HTMLNames::selectTag) || element.hasTagName(WebCore::HTMLNames::inputTag) || element.hasTagName(WebCore::HTMLNames::textareaTag) || element.hasEditableStyle()) {
+ if (is<HTMLSelectElement>(element) || isTextFormControlOrEditableContent(element)) {
m_focusedElement = &element;
#if PLATFORM(IOS_FAMILY)
@@ -5399,17 +5406,18 @@
void WebPage::focusedElementDidChangeInputMode(WebCore::Element& element, WebCore::InputMode mode)
{
+ if (m_focusedElement != &element)
+ return;
+
#if PLATFORM(IOS_FAMILY)
- ASSERT(m_focusedElement == &element);
ASSERT(is<HTMLElement>(element));
ASSERT(downcast<HTMLElement>(element).canonicalInputMode() == mode);
- if (!is<HTMLTextAreaElement>(*m_focusedElement) && !is<HTMLInputElement>(*m_focusedElement) && !m_focusedElement->hasEditableStyle())
+ if (!isTextFormControlOrEditableContent(element))
return;
send(Messages::WebPageProxy::FocusedElementDidChangeInputMode(mode));
#else
- UNUSED_PARAM(element);
UNUSED_PARAM(mode);
#endif
}
