Title: [264248] trunk
- Revision
- 264248
- Author
- [email protected]
- Date
- 2020-07-10 17:30:24 -0700 (Fri, 10 Jul 2020)
Log Message
[iOS] Prevent SPI clients from making the minimum layout height or width negative
https://bugs.webkit.org/show_bug.cgi?id=214199
<rdar://problem/64109242>
Reviewed by Tim Horton.
Source/WebKit:
It's an error in the embedding client to override the minimum layout size with a negative width or height (in
this case, Mail on iOS). This happens when double tapping on a contact pill in the "To:" line in Mail compose,
which causes the top content inset of the web view's scroll view to increase such that Mail's logic for
overriding layout width ends up passing a negative height.
After a recent change (<https://trac.webkit.org/r261874>), this now results in the web view immediately
scrolling to an incorrect content offset when rotating into landscape mode after double tapping a contact. Fix
this by clamping the overridden layout size to a minimum of (0, 0), to prevent SPI clients from triggering
subtle bugs like this in the future.
Test: WebKit.OverrideMinimumLayoutSizeWithNegativeHeight
* UIProcess/API/ios/WKWebViewIOS.mm:
(-[WKWebView _overrideLayoutParametersWithMinimumLayoutSize:maximumUnobscuredSizeOverride:]):
Tools:
* TestWebKitAPI/Tests/WebKitCocoa/FixedLayoutSize.mm:
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (264247 => 264248)
--- trunk/Source/WebKit/ChangeLog 2020-07-10 23:59:56 UTC (rev 264247)
+++ trunk/Source/WebKit/ChangeLog 2020-07-11 00:30:24 UTC (rev 264248)
@@ -1,3 +1,26 @@
+2020-07-10 Wenson Hsieh <[email protected]>
+
+ [iOS] Prevent SPI clients from making the minimum layout height or width negative
+ https://bugs.webkit.org/show_bug.cgi?id=214199
+ <rdar://problem/64109242>
+
+ Reviewed by Tim Horton.
+
+ It's an error in the embedding client to override the minimum layout size with a negative width or height (in
+ this case, Mail on iOS). This happens when double tapping on a contact pill in the "To:" line in Mail compose,
+ which causes the top content inset of the web view's scroll view to increase such that Mail's logic for
+ overriding layout width ends up passing a negative height.
+
+ After a recent change (<https://trac.webkit.org/r261874>), this now results in the web view immediately
+ scrolling to an incorrect content offset when rotating into landscape mode after double tapping a contact. Fix
+ this by clamping the overridden layout size to a minimum of (0, 0), to prevent SPI clients from triggering
+ subtle bugs like this in the future.
+
+ Test: WebKit.OverrideMinimumLayoutSizeWithNegativeHeight
+
+ * UIProcess/API/ios/WKWebViewIOS.mm:
+ (-[WKWebView _overrideLayoutParametersWithMinimumLayoutSize:maximumUnobscuredSizeOverride:]):
+
2020-07-08 Darin Adler <[email protected]>
Remove live ranges from Document.h, AlternativeTextController.h, DictionaryLookup.h, and WebPage.h
Modified: trunk/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm (264247 => 264248)
--- trunk/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm 2020-07-10 23:59:56 UTC (rev 264247)
+++ trunk/Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm 2020-07-11 00:30:24 UTC (rev 264248)
@@ -2943,7 +2943,10 @@
{
LOG_WITH_STREAM(VisibleRects, stream << "-[WKWebView " << _page->identifier() << " _overrideLayoutParametersWithMinimumLayoutSize:" << WebCore::FloatSize(minimumLayoutSize) << " maximumUnobscuredSizeOverride:" << WebCore::FloatSize(maximumUnobscuredSizeOverride) << "]");
- [self _setViewLayoutSizeOverride:minimumLayoutSize];
+ if (minimumLayoutSize.width < 0 || minimumLayoutSize.height < 0)
+ RELEASE_LOG_FAULT(VisibleRects, "%s: Error: attempting to override layout parameters with negative width or height: %@", __PRETTY_FUNCTION__, NSStringFromCGSize(minimumLayoutSize));
+
+ [self _setViewLayoutSizeOverride:CGSizeMake(std::max<CGFloat>(0, minimumLayoutSize.width), std::max<CGFloat>(0, minimumLayoutSize.height))];
[self _setMaximumUnobscuredSizeOverride:maximumUnobscuredSizeOverride];
}
Modified: trunk/Tools/ChangeLog (264247 => 264248)
--- trunk/Tools/ChangeLog 2020-07-10 23:59:56 UTC (rev 264247)
+++ trunk/Tools/ChangeLog 2020-07-11 00:30:24 UTC (rev 264248)
@@ -1,3 +1,13 @@
+2020-07-10 Wenson Hsieh <[email protected]>
+
+ [iOS] Prevent SPI clients from making the minimum layout height or width negative
+ https://bugs.webkit.org/show_bug.cgi?id=214199
+ <rdar://problem/64109242>
+
+ Reviewed by Tim Horton.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/FixedLayoutSize.mm:
+
2020-07-10 Geoffrey Garen <[email protected]>
Add some testing for JSRunLoopTimer
Modified: trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/FixedLayoutSize.mm (264247 => 264248)
--- trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/FixedLayoutSize.mm 2020-07-10 23:59:56 UTC (rev 264247)
+++ trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/FixedLayoutSize.mm 2020-07-11 00:30:24 UTC (rev 264248)
@@ -27,12 +27,23 @@
#import "PlatformUtilities.h"
#import "TestNavigationDelegate.h"
+#import "TestWKWebView.h"
#import <WebKit/WKPreferences.h>
#import <WebKit/WKWebViewPrivate.h>
#import <wtf/RetainPtr.h>
-#if !PLATFORM(IOS_FAMILY)
+#if PLATFORM(IOS_FAMILY)
+TEST(WebKit, OverrideMinimumLayoutSizeWithNegativeHeight)
+{
+ auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:CGRectMake(0, 0, 320, 500)]);
+ [webView _overrideLayoutParametersWithMinimumLayoutSize:CGSizeMake(320, -1000) maximumUnobscuredSizeOverride:CGSizeMake(0, 0)];
+ [webView synchronouslyLoadHTMLString:@"<meta name='viewport' content='width=device-width, initial-scale=1'><body>Hello</body>"];
+ EXPECT_GE([webView _fixedLayoutSize].height, 0);
+}
+
+#else
+
static bool fixedLayoutSizeDone;
static bool fixedLayoutSizeAfterNavigationDone;
static bool fixedLayoutSizeDisabledDone;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
