Diff
Modified: tags/Safari-608.1.32.1/LayoutTests/ChangeLog (246936 => 246937)
--- tags/Safari-608.1.32.1/LayoutTests/ChangeLog 2019-06-28 21:01:56 UTC (rev 246936)
+++ tags/Safari-608.1.32.1/LayoutTests/ChangeLog 2019-06-28 21:01:59 UTC (rev 246937)
@@ -1,3 +1,41 @@
+2019-06-28 Kocsen Chung <kocsen_ch...@apple.com>
+
+ Cherry-pick r246835. rdar://problem/51787961
+
+ [ContentChangeObserver] Dispatch synthetic mouse event asynchronously in completePendingSyntheticClickForContentChangeObserver
+ https://bugs.webkit.org/show_bug.cgi?id=199220
+ <rdar://problem/51787961>
+
+ Reviewed by Simon Fraser.
+
+ Source/WebKit:
+
+ WebPage::completePendingSyntheticClickForContentChangeObserver should not dispatch mouse events synchronously.
+ Mouse events, through style updates could destroy the element that initiated this change.
+ WebPage::handleSyntheticClick() already implements this pattern.
+
+ * WebProcess/WebPage/ios/WebPageIOS.mm:
+ (WebKit::WebPage::completePendingSyntheticClickForContentChangeObserver):
+
+ LayoutTests:
+
+ * fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash-expected.txt: Added.
+ * fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246835 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-06-26 Zalan Bujtas <za...@apple.com>
+
+ [ContentChangeObserver] Dispatch synthetic mouse event asynchronously in completePendingSyntheticClickForContentChangeObserver
+ https://bugs.webkit.org/show_bug.cgi?id=199220
+ <rdar://problem/51787961>
+
+ Reviewed by Simon Fraser.
+
+ * fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash-expected.txt: Added.
+ * fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash.html: Added.
+
2019-06-25 Russell Epstein <russel...@apple.com>
Layout Test imported/blink/editing/selection/deleteFromDocument-crash.html is failing.
Added: tags/Safari-608.1.32.1/LayoutTests/fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash-expected.txt (0 => 246937)
--- tags/Safari-608.1.32.1/LayoutTests/fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash-expected.txt (rev 0)
+++ tags/Safari-608.1.32.1/LayoutTests/fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash-expected.txt 2019-06-28 21:01:59 UTC (rev 246937)
@@ -0,0 +1,2 @@
+PASS if no crash or assert.
+
Added: tags/Safari-608.1.32.1/LayoutTests/fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash.html (0 => 246937)
--- tags/Safari-608.1.32.1/LayoutTests/fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash.html (rev 0)
+++ tags/Safari-608.1.32.1/LayoutTests/fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash.html 2019-06-28 21:01:59 UTC (rev 246937)
@@ -0,0 +1,59 @@
+<!DOCTYPE html><!-- webkit-test-runner [ useFlexibleViewport=true ] -->
+<html>
+<head>
+<title>This tests the case when visible content change happens through transition and the click removes the animated element.</title>
+<script src=""
+<style>
+#tapthis {
+ width: 400px;
+ height: 400px;
+ border: 1px solid green;
+}
+
+#becomesVisible {
+ opacity: 0;
+ width: 100px;
+ height: 100px;
+ background-color: green;
+ transition: opacity 80ms ease-out 0ms;
+}
+</style>
+<script>
+async function test() {
+ if (!window.testRunner || !testRunner.runUIScript)
+ return;
+ if (window.internals)
+ internals.settings.setContentChangeObserverEnabled(true);
+
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+
+ let rect = tapthis.getBoundingClientRect();
+ let x = rect.left + rect.width / 2;
+ let y = rect.top + rect.height / 2;
+
+ await tapAtPoint(x, y);
+}
+</script>
+</head>
+<body _onload_="test()">
+<div id=tapthis>PASS if no crash or assert.</div>
+<div id=becomesVisible></div>
+<pre id=result></pre>
+<script>
+tapthis.addEventListener("mouseover", function( event ) {
+ becomesVisible.style.opacity = "1";
+ setTimeout(function() {
+ document.body.offsetHeight;
+ }, 50);
+}, false);
+
+tapthis.addEventListener("click", function( event ) {
+ becomesVisible.remove();
+ document.body.offsetHeight;
+ if (window.testRunner)
+ testRunner.notifyDone();
+}, false);
+</script>
+</body>
+</html>
Modified: tags/Safari-608.1.32.1/Source/WebKit/ChangeLog (246936 => 246937)
--- tags/Safari-608.1.32.1/Source/WebKit/ChangeLog 2019-06-28 21:01:56 UTC (rev 246936)
+++ tags/Safari-608.1.32.1/Source/WebKit/ChangeLog 2019-06-28 21:01:59 UTC (rev 246937)
@@ -1,5 +1,47 @@
2019-06-28 Kocsen Chung <kocsen_ch...@apple.com>
+ Cherry-pick r246835. rdar://problem/51787961
+
+ [ContentChangeObserver] Dispatch synthetic mouse event asynchronously in completePendingSyntheticClickForContentChangeObserver
+ https://bugs.webkit.org/show_bug.cgi?id=199220
+ <rdar://problem/51787961>
+
+ Reviewed by Simon Fraser.
+
+ Source/WebKit:
+
+ WebPage::completePendingSyntheticClickForContentChangeObserver should not dispatch mouse events synchronously.
+ Mouse events, through style updates could destroy the element that initiated this change.
+ WebPage::handleSyntheticClick() already implements this pattern.
+
+ * WebProcess/WebPage/ios/WebPageIOS.mm:
+ (WebKit::WebPage::completePendingSyntheticClickForContentChangeObserver):
+
+ LayoutTests:
+
+ * fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash-expected.txt: Added.
+ * fast/events/touch/ios/content-observation/animation-end-with-visiblity-change-crash.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246835 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-06-26 Zalan Bujtas <za...@apple.com>
+
+ [ContentChangeObserver] Dispatch synthetic mouse event asynchronously in completePendingSyntheticClickForContentChangeObserver
+ https://bugs.webkit.org/show_bug.cgi?id=199220
+ <rdar://problem/51787961>
+
+ Reviewed by Simon Fraser.
+
+ WebPage::completePendingSyntheticClickForContentChangeObserver should not dispatch mouse events synchronously.
+ Mouse events, through style updates could destroy the element that initiated this change.
+ WebPage::handleSyntheticClick() already implements this pattern.
+
+ * WebProcess/WebPage/ios/WebPageIOS.mm:
+ (WebKit::WebPage::completePendingSyntheticClickForContentChangeObserver):
+
+2019-06-28 Kocsen Chung <kocsen_ch...@apple.com>
+
Cherry-pick r246901. rdar://problem/52202948
Regression(r246526): StorageManager thread hangs
Modified: tags/Safari-608.1.32.1/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm (246936 => 246937)
--- tags/Safari-608.1.32.1/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm 2019-06-28 21:01:56 UTC (rev 246936)
+++ tags/Safari-608.1.32.1/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm 2019-06-28 21:01:59 UTC (rev 246937)
@@ -714,18 +714,24 @@
if (!m_pendingSyntheticClickNode)
return;
auto observedContentChange = m_pendingSyntheticClickNode->document().contentChangeObserver().observedContentChange();
- // Only dispatch the click if the document didn't get changed by any timers started by the move event.
- if (observedContentChange == WKContentNoChange) {
- LOG(ContentObservation, "No chage was observed -> click.");
- completeSyntheticClick(*m_pendingSyntheticClickNode, m_pendingSyntheticClickLocation, m_pendingSyntheticClickModifiers, WebCore::OneFingerTap, m_pendingSyntheticClickPointerId);
- } else {
+ callOnMainThread([protectedThis = makeRefPtr(this), targetNode = Ref<Node>(*m_pendingSyntheticClickNode), originalDocument = makeWeakPtr(m_pendingSyntheticClickNode->document()), observedContentChange, location = m_pendingSyntheticClickLocation, modifiers = m_pendingSyntheticClickModifiers, pointerId = m_pendingSyntheticClickPointerId] {
+ if (protectedThis->m_isClosed || !protectedThis->corePage())
+ return;
+ if (!originalDocument || &targetNode->document() != originalDocument)
+ return;
+
+ // Only dispatch the click if the document didn't get changed by any timers started by the move event.
+ if (observedContentChange == WKContentNoChange) {
+ LOG(ContentObservation, "No chage was observed -> click.");
+ protectedThis->completeSyntheticClick(targetNode, location, modifiers, WebCore::OneFingerTap, pointerId);
+ return;
+ }
// Ensure that the mouse is on the most recent content.
- dispatchSyntheticMouseMove(m_page->mainFrame(), m_pendingSyntheticClickLocation, m_pendingSyntheticClickModifiers, m_pendingSyntheticClickPointerId);
LOG(ContentObservation, "Observed meaningful visible change -> hover.");
- }
-
+ dispatchSyntheticMouseMove(protectedThis->corePage()->mainFrame(), location, modifiers, pointerId);
+ });
m_pendingSyntheticClickNode = nullptr;
- m_pendingSyntheticClickLocation = FloatPoint();
+ m_pendingSyntheticClickLocation = { };
m_pendingSyntheticClickModifiers = { };
m_pendingSyntheticClickPointerId = 0;
}
