Title: [245924] branches/safari-607-branch
- Revision
- 245924
- Author
- [email protected]
- Date
- 2019-05-30 17:30:10 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r245509. rdar://problem/51264845
Wait to get frame until after layout has been run
https://bugs.webkit.org/show_bug.cgi?id=197999
<rdar://problem/50800345>
Reviewed by Alex Christensen.
Source/WebCore:
The current frame can change when layout runs, so don't bother retrieving
the frame until the final layout pass is complete.
Test: fast/dom/window-inner-width-crash.html
* page/DOMWindow.cpp:
(WebCore::DOMWindow::innerHeight const): Move frame access past the
layout operation.
(WebCore::DOMWindow::innerWidth const): Ditto.
(WebCore::DOMWindow::scrollX const): Ditto.
(WebCore::DOMWindow::scrollY const): Ditto.
LayoutTests:
* fast/dom/window-inner-width-crash-expected.txt: Added.
* fast/dom/window-inner-width-crash.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (245923 => 245924)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:07 UTC (rev 245923)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:10 UTC (rev 245924)
@@ -1,5 +1,47 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245509. rdar://problem/51264845
+
+ Wait to get frame until after layout has been run
+ https://bugs.webkit.org/show_bug.cgi?id=197999
+ <rdar://problem/50800345>
+
+ Reviewed by Alex Christensen.
+
+ Source/WebCore:
+
+ The current frame can change when layout runs, so don't bother retrieving
+ the frame until the final layout pass is complete.
+
+ Test: fast/dom/window-inner-width-crash.html
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::innerHeight const): Move frame access past the
+ layout operation.
+ (WebCore::DOMWindow::innerWidth const): Ditto.
+ (WebCore::DOMWindow::scrollX const): Ditto.
+ (WebCore::DOMWindow::scrollY const): Ditto.
+
+ LayoutTests:
+
+ * fast/dom/window-inner-width-crash-expected.txt: Added.
+ * fast/dom/window-inner-width-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-19 Brent Fulgham <[email protected]>
+
+ Wait to get frame until after layout has been run
+ https://bugs.webkit.org/show_bug.cgi?id=197999
+ <rdar://problem/50800345>
+
+ Reviewed by Alex Christensen.
+
+ * fast/dom/window-inner-width-crash-expected.txt: Added.
+ * fast/dom/window-inner-width-crash.html: Added.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245361. rdar://problem/51264842
Do not create a shape object outside of the layout context
Added: branches/safari-607-branch/LayoutTests/fast/dom/window-inner-width-crash-expected.txt (0 => 245924)
--- branches/safari-607-branch/LayoutTests/fast/dom/window-inner-width-crash-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/dom/window-inner-width-crash-expected.txt 2019-05-31 00:30:10 UTC (rev 245924)
@@ -0,0 +1,4 @@
+This test passes if it does not crash.
+
+
+
Added: branches/safari-607-branch/LayoutTests/fast/dom/window-inner-width-crash.html (0 => 245924)
--- branches/safari-607-branch/LayoutTests/fast/dom/window-inner-width-crash.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/dom/window-inner-width-crash.html 2019-05-31 00:30:10 UTC (rev 245924)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function runTest() {
+ button.autofocus = true;
+ body.appendChild(paragraph);
+ var testVal = window[0].innerWidth;
+}
+
+function fireSelect() {
+ input.select();
+}
+
+function appendToSelect() {
+ select.appendChild(frame);
+}
+</script>
+</head>
+<body id="body" _onload_="runTest()">
+ <p>This test passes if it does not crash.</p>
+ <iframe id="frame"></iframe>
+ <p id="paragraph">
+ <button id="button" _onkeydown_="appendToSelect()"></button>
+ <style _onload_="fireSelect()"></style>
+ <li></li>
+ <select id="select">
+ <input id="input" for="" _onblur_="appendToSelect()"></input>
+ </select>
+</body>
+</html>
\ No newline at end of file
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (245923 => 245924)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:07 UTC (rev 245923)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:10 UTC (rev 245924)
@@ -1,5 +1,56 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245509. rdar://problem/51264845
+
+ Wait to get frame until after layout has been run
+ https://bugs.webkit.org/show_bug.cgi?id=197999
+ <rdar://problem/50800345>
+
+ Reviewed by Alex Christensen.
+
+ Source/WebCore:
+
+ The current frame can change when layout runs, so don't bother retrieving
+ the frame until the final layout pass is complete.
+
+ Test: fast/dom/window-inner-width-crash.html
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::innerHeight const): Move frame access past the
+ layout operation.
+ (WebCore::DOMWindow::innerWidth const): Ditto.
+ (WebCore::DOMWindow::scrollX const): Ditto.
+ (WebCore::DOMWindow::scrollY const): Ditto.
+
+ LayoutTests:
+
+ * fast/dom/window-inner-width-crash-expected.txt: Added.
+ * fast/dom/window-inner-width-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-19 Brent Fulgham <[email protected]>
+
+ Wait to get frame until after layout has been run
+ https://bugs.webkit.org/show_bug.cgi?id=197999
+ <rdar://problem/50800345>
+
+ Reviewed by Alex Christensen.
+
+ The current frame can change when layout runs, so don't bother retrieving
+ the frame until the final layout pass is complete.
+
+ Test: fast/dom/window-inner-width-crash.html
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::innerHeight const): Move frame access past the
+ layout operation.
+ (WebCore::DOMWindow::innerWidth const): Ditto.
+ (WebCore::DOMWindow::scrollX const): Ditto.
+ (WebCore::DOMWindow::scrollY const): Ditto.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245464. rdar://problem/51264866
Hardening: Prevent FrameLoader crash due to SetForScope
Modified: branches/safari-607-branch/Source/WebCore/page/DOMWindow.cpp (245923 => 245924)
--- branches/safari-607-branch/Source/WebCore/page/DOMWindow.cpp 2019-05-31 00:30:07 UTC (rev 245923)
+++ branches/safari-607-branch/Source/WebCore/page/DOMWindow.cpp 2019-05-31 00:30:10 UTC (rev 245924)
@@ -1236,14 +1236,17 @@
int DOMWindow::innerHeight() const
{
- auto* frame = this->frame();
- if (!frame)
+ if (!frame())
return 0;
-
+
// Force enough layout in the parent document to ensure that the FrameView has been resized.
if (auto* frameElement = this->frameElement())
frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, HeightDimensionsCheck);
+ auto* frame = this->frame();
+ if (!frame)
+ return 0;
+
FrameView* view = frame->view();
if (!view)
return 0;
@@ -1253,8 +1256,7 @@
int DOMWindow::innerWidth() const
{
- auto* frame = this->frame();
- if (!frame)
+ if (!frame())
return 0;
// Force enough layout in the parent document to ensure that the FrameView has been resized.
@@ -1261,6 +1263,10 @@
if (auto* frameElement = this->frameElement())
frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, WidthDimensionsCheck);
+ auto* frame = this->frame();
+ if (!frame)
+ return 0;
+
FrameView* view = frame->view();
if (!view)
return 0;
@@ -1310,7 +1316,16 @@
frame->document()->updateLayoutIgnorePendingStylesheets();
- return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().x());
+ // Layout may have affected the current frame:
+ auto* frameAfterLayout = this->frame();
+ if (!frameAfterLayout)
+ return 0;
+
+ FrameView* viewAfterLayout = frameAfterLayout->view();
+ if (!viewAfterLayout)
+ return 0;
+
+ return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().x());
}
int DOMWindow::scrollY() const
@@ -1329,7 +1344,16 @@
frame->document()->updateLayoutIgnorePendingStylesheets();
- return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().y());
+ // Layout may have affected the current frame:
+ auto* frameAfterLayout = this->frame();
+ if (!frameAfterLayout)
+ return 0;
+
+ FrameView* viewAfterLayout = frameAfterLayout->view();
+ if (!viewAfterLayout)
+ return 0;
+
+ return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().y());
}
bool DOMWindow::closed() const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
