Title: [274632] releases/WebKitGTK/webkit-2.30/Source/WebCore
- Revision
- 274632
- Author
- [email protected]
- Date
- 2021-03-18 04:03:56 -0700 (Thu, 18 Mar 2021)
Log Message
Merge r267287 - Crash under WebCore::shouldResetFocusNavigationStartingNode()
https://bugs.webkit.org/show_bug.cgi?id=216714
<rdar://problem/68132047>
Reviewed by Darin Adler.
Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
it stays alive until the time we pass it to setFocusNavigationStartingNode().
* page/FrameView.cpp:
(WebCore::FrameView::scrollToFragmentInternal):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.30/Source/WebCore/ChangeLog (274631 => 274632)
--- releases/WebKitGTK/webkit-2.30/Source/WebCore/ChangeLog 2021-03-18 11:03:49 UTC (rev 274631)
+++ releases/WebKitGTK/webkit-2.30/Source/WebCore/ChangeLog 2021-03-18 11:03:56 UTC (rev 274632)
@@ -1,3 +1,17 @@
+2020-09-18 Chris Dumez <[email protected]>
+
+ Crash under WebCore::shouldResetFocusNavigationStartingNode()
+ https://bugs.webkit.org/show_bug.cgi?id=216714
+ <rdar://problem/68132047>
+
+ Reviewed by Darin Adler.
+
+ Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
+ it stays alive until the time we pass it to setFocusNavigationStartingNode().
+
+ * page/FrameView.cpp:
+ (WebCore::FrameView::scrollToFragmentInternal):
+
2020-08-13 Chris Dumez <[email protected]>
REGRESSION (r260684): Messages YouTube inline video: after Multitasking away and Back, Audio is heard but icon indicates "muted"
Modified: releases/WebKitGTK/webkit-2.30/Source/WebCore/page/FrameView.cpp (274631 => 274632)
--- releases/WebKitGTK/webkit-2.30/Source/WebCore/page/FrameView.cpp 2021-03-18 11:03:49 UTC (rev 274631)
+++ releases/WebKitGTK/webkit-2.30/Source/WebCore/page/FrameView.cpp 2021-03-18 11:03:56 UTC (rev 274632)
@@ -2207,12 +2207,12 @@
auto& document = *frame().document();
RELEASE_ASSERT(document.haveStylesheetsLoaded());
- Element* anchorElement = document.findAnchor(fragmentIdentifier);
+ auto anchorElement = makeRefPtr(document.findAnchor(fragmentIdentifier));
- LOG(Scrolling, " anchorElement is %p", anchorElement);
+ LOG(Scrolling, " anchorElement is %p", anchorElement.get());
// Setting to null will clear the current target.
- document.setCSSTarget(anchorElement);
+ document.setCSSTarget(anchorElement.get());
if (is<SVGDocument>(document)) {
if (fragmentIdentifier.isEmpty())
@@ -2229,18 +2229,18 @@
return false;
}
- ContainerNode* scrollPositionAnchor = anchorElement;
+ RefPtr<ContainerNode> scrollPositionAnchor = anchorElement;
if (!scrollPositionAnchor)
scrollPositionAnchor = frame().document();
- maintainScrollPositionAtAnchor(scrollPositionAnchor);
+ maintainScrollPositionAtAnchor(scrollPositionAnchor.get());
// If the anchor accepts keyboard focus, move focus there to aid users relying on keyboard navigation.
if (anchorElement) {
if (anchorElement->isFocusable())
- document.setFocusedElement(anchorElement);
+ document.setFocusedElement(anchorElement.get());
else {
document.setFocusedElement(nullptr);
- document.setFocusNavigationStartingNode(anchorElement);
+ document.setFocusNavigationStartingNode(anchorElement.get());
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
