Title: [245509] trunk
- Revision
- 245509
- Author
- [email protected]
- Date
- 2019-05-19 20:15:30 -0700 (Sun, 19 May 2019)
Log Message
Wait to get frame until after layout has been run
https://bugs.webkit.org/show_bug.cgi?id=197999
<rdar://problem/50800345>
Reviewed by Alex Christensen.
Source/WebCore:
The current frame can change when layout runs, so don't bother retrieving
the frame until the final layout pass is complete.
Test: fast/dom/window-inner-width-crash.html
* page/DOMWindow.cpp:
(WebCore::DOMWindow::innerHeight const): Move frame access past the
layout operation.
(WebCore::DOMWindow::innerWidth const): Ditto.
(WebCore::DOMWindow::scrollX const): Ditto.
(WebCore::DOMWindow::scrollY const): Ditto.
LayoutTests:
* fast/dom/window-inner-width-crash-expected.txt: Added.
* fast/dom/window-inner-width-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (245508 => 245509)
--- trunk/LayoutTests/ChangeLog 2019-05-20 00:48:59 UTC (rev 245508)
+++ trunk/LayoutTests/ChangeLog 2019-05-20 03:15:30 UTC (rev 245509)
@@ -1,3 +1,14 @@
+2019-05-19 Brent Fulgham <[email protected]>
+
+ Wait to get frame until after layout has been run
+ https://bugs.webkit.org/show_bug.cgi?id=197999
+ <rdar://problem/50800345>
+
+ Reviewed by Alex Christensen.
+
+ * fast/dom/window-inner-width-crash-expected.txt: Added.
+ * fast/dom/window-inner-width-crash.html: Added.
+
2019-05-19 Antoine Quint <[email protected]>
[Pointer Events] Listening to a "pointerover", "pointerenter", "pointerout" or "pointerleave" event alone does not fire the event on iOS
Added: trunk/LayoutTests/fast/dom/window-inner-width-crash-expected.txt (0 => 245509)
--- trunk/LayoutTests/fast/dom/window-inner-width-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/window-inner-width-crash-expected.txt 2019-05-20 03:15:30 UTC (rev 245509)
@@ -0,0 +1,4 @@
+This test passes if it does not crash.
+
+
+
Added: trunk/LayoutTests/fast/dom/window-inner-width-crash.html (0 => 245509)
--- trunk/LayoutTests/fast/dom/window-inner-width-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/window-inner-width-crash.html 2019-05-20 03:15:30 UTC (rev 245509)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function runTest() {
+ button.autofocus = true;
+ body.appendChild(paragraph);
+ var testVal = window[0].innerWidth;
+}
+
+function fireSelect() {
+ input.select();
+}
+
+function appendToSelect() {
+ select.appendChild(frame);
+}
+</script>
+</head>
+<body id="body" _onload_="runTest()">
+ <p>This test passes if it does not crash.</p>
+ <iframe id="frame"></iframe>
+ <p id="paragraph">
+ <button id="button" _onkeydown_="appendToSelect()"></button>
+ <style _onload_="fireSelect()"></style>
+ <li></li>
+ <select id="select">
+ <input id="input" for="" _onblur_="appendToSelect()"></input>
+ </select>
+</body>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (245508 => 245509)
--- trunk/Source/WebCore/ChangeLog 2019-05-20 00:48:59 UTC (rev 245508)
+++ trunk/Source/WebCore/ChangeLog 2019-05-20 03:15:30 UTC (rev 245509)
@@ -1,5 +1,25 @@
2019-05-19 Brent Fulgham <[email protected]>
+ Wait to get frame until after layout has been run
+ https://bugs.webkit.org/show_bug.cgi?id=197999
+ <rdar://problem/50800345>
+
+ Reviewed by Alex Christensen.
+
+ The current frame can change when layout runs, so don't bother retrieving
+ the frame until the final layout pass is complete.
+
+ Test: fast/dom/window-inner-width-crash.html
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::innerHeight const): Move frame access past the
+ layout operation.
+ (WebCore::DOMWindow::innerWidth const): Ditto.
+ (WebCore::DOMWindow::scrollX const): Ditto.
+ (WebCore::DOMWindow::scrollY const): Ditto.
+
+2019-05-19 Brent Fulgham <[email protected]>
+
Unreviewed build fix
Attempting to build with only Open Source sources on shipping software with
Modified: trunk/Source/WebCore/page/DOMWindow.cpp (245508 => 245509)
--- trunk/Source/WebCore/page/DOMWindow.cpp 2019-05-20 00:48:59 UTC (rev 245508)
+++ trunk/Source/WebCore/page/DOMWindow.cpp 2019-05-20 03:15:30 UTC (rev 245509)
@@ -1229,14 +1229,17 @@
int DOMWindow::innerHeight() const
{
- auto* frame = this->frame();
- if (!frame)
+ if (!frame())
return 0;
-
+
// Force enough layout in the parent document to ensure that the FrameView has been resized.
if (auto* frameElement = this->frameElement())
frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, HeightDimensionsCheck);
+ auto* frame = this->frame();
+ if (!frame)
+ return 0;
+
FrameView* view = frame->view();
if (!view)
return 0;
@@ -1246,8 +1249,7 @@
int DOMWindow::innerWidth() const
{
- auto* frame = this->frame();
- if (!frame)
+ if (!frame())
return 0;
// Force enough layout in the parent document to ensure that the FrameView has been resized.
@@ -1254,6 +1256,10 @@
if (auto* frameElement = this->frameElement())
frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, WidthDimensionsCheck);
+ auto* frame = this->frame();
+ if (!frame)
+ return 0;
+
FrameView* view = frame->view();
if (!view)
return 0;
@@ -1303,7 +1309,16 @@
frame->document()->updateLayoutIgnorePendingStylesheets();
- return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().x());
+ // Layout may have affected the current frame:
+ auto* frameAfterLayout = this->frame();
+ if (!frameAfterLayout)
+ return 0;
+
+ FrameView* viewAfterLayout = frameAfterLayout->view();
+ if (!viewAfterLayout)
+ return 0;
+
+ return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().x());
}
int DOMWindow::scrollY() const
@@ -1322,7 +1337,16 @@
frame->document()->updateLayoutIgnorePendingStylesheets();
- return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().y());
+ // Layout may have affected the current frame:
+ auto* frameAfterLayout = this->frame();
+ if (!frameAfterLayout)
+ return 0;
+
+ FrameView* viewAfterLayout = frameAfterLayout->view();
+ if (!viewAfterLayout)
+ return 0;
+
+ return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().y());
}
bool DOMWindow::closed() const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
