Title: [276547] trunk
- Revision
- 276547
- Author
- [email protected]
- Date
- 2021-04-24 00:41:54 -0700 (Sat, 24 Apr 2021)
Log Message
Move selectedOptions cache invalidation timing
https://bugs.webkit.org/show_bug.cgi?id=224894
Patch by Rob Buis <[email protected]> on 2021-04-24
Reviewed by Ryosuke Niwa.
Source/WebCore:
Move selectedOptions cache invalidation timing out
of setSelectedState, having it in setSelectedState
can cause selectedOptions cache invalidation while
determining the cache.
Test: fast/dom/HTMLSelectElement/selected-options-item-crash.html
* html/HTMLOptionElement.cpp:
(WebCore::HTMLOptionElement::setSelectedState):
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::updateListBoxSelection):
(WebCore::HTMLSelectElement::selectOption):
(WebCore::HTMLSelectElement::deselectItemsWithoutValidation):
(WebCore::HTMLSelectElement::restoreFormControlState):
(WebCore::HTMLSelectElement::reset):
(WebCore::HTMLSelectElement::updateSelectedState):
LayoutTests:
Add test for this.
* fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt: Added.
* fast/dom/HTMLSelectElement/selected-options-item-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (276546 => 276547)
--- trunk/LayoutTests/ChangeLog 2021-04-24 06:11:00 UTC (rev 276546)
+++ trunk/LayoutTests/ChangeLog 2021-04-24 07:41:54 UTC (rev 276547)
@@ -1,3 +1,15 @@
+2021-04-24 Rob Buis <[email protected]>
+
+ Move selectedOptions cache invalidation timing
+ https://bugs.webkit.org/show_bug.cgi?id=224894
+
+ Reviewed by Ryosuke Niwa.
+
+ Add test for this.
+
+ * fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt: Added.
+ * fast/dom/HTMLSelectElement/selected-options-item-crash.html: Added.
+
2021-04-23 Chris Dumez <[email protected]>
http/tests/security/referrer-policy-header.html is slow
Added: trunk/LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt (0 => 276547)
--- trunk/LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash-expected.txt 2021-04-24 07:41:54 UTC (rev 276547)
@@ -0,0 +1,10 @@
+This tests accesses a particular index in selectedOptions via HTMLSelectElement's item. WebKit should not crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS select.selectedOptions.item(2) is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash.html (0 => 276547)
--- trunk/LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/HTMLSelectElement/selected-options-item-crash.html 2021-04-24 07:41:54 UTC (rev 276547)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+
+description('This tests accesses a particular index in selectedOptions via HTMLSelectElement\'s item. WebKit should not crash.');
+
+let select = document.createElement('select');
+document.body.appendChild(select);
+let div = document.createElement('div');
+select.appendChild(div);
+select.appendChild(document.createElement('option'));
+let select2 = document.createElement('select');
+select2.appendChild(document.createElement('option'));
+div.appendChild(select2);
+
+shouldBe('select.selectedOptions.item(2)', 'null');
+
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (276546 => 276547)
--- trunk/Source/WebCore/ChangeLog 2021-04-24 06:11:00 UTC (rev 276546)
+++ trunk/Source/WebCore/ChangeLog 2021-04-24 07:41:54 UTC (rev 276547)
@@ -1,3 +1,27 @@
+2021-04-24 Rob Buis <[email protected]>
+
+ Move selectedOptions cache invalidation timing
+ https://bugs.webkit.org/show_bug.cgi?id=224894
+
+ Reviewed by Ryosuke Niwa.
+
+ Move selectedOptions cache invalidation timing out
+ of setSelectedState, having it in setSelectedState
+ can cause selectedOptions cache invalidation while
+ determining the cache.
+
+ Test: fast/dom/HTMLSelectElement/selected-options-item-crash.html
+
+ * html/HTMLOptionElement.cpp:
+ (WebCore::HTMLOptionElement::setSelectedState):
+ * html/HTMLSelectElement.cpp:
+ (WebCore::HTMLSelectElement::updateListBoxSelection):
+ (WebCore::HTMLSelectElement::selectOption):
+ (WebCore::HTMLSelectElement::deselectItemsWithoutValidation):
+ (WebCore::HTMLSelectElement::restoreFormControlState):
+ (WebCore::HTMLSelectElement::reset):
+ (WebCore::HTMLSelectElement::updateSelectedState):
+
2021-04-23 Ian Gilbert <[email protected]>
Crash in IndentOutdentCommand::outdentParagraph attempting to move a paragraph
Modified: trunk/Source/WebCore/html/HTMLOptionElement.cpp (276546 => 276547)
--- trunk/Source/WebCore/html/HTMLOptionElement.cpp 2021-04-24 06:11:00 UTC (rev 276546)
+++ trunk/Source/WebCore/html/HTMLOptionElement.cpp 2021-04-24 07:41:54 UTC (rev 276547)
@@ -234,9 +234,6 @@
m_isSelected = selected;
invalidateStyleForSubtree();
-
- if (RefPtr<HTMLSelectElement> select = ownerSelectElement())
- select->invalidateSelectedItems();
}
void HTMLOptionElement::childrenChanged(const ChildChange& change)
Modified: trunk/Source/WebCore/html/HTMLSelectElement.cpp (276546 => 276547)
--- trunk/Source/WebCore/html/HTMLSelectElement.cpp 2021-04-24 06:11:00 UTC (rev 276546)
+++ trunk/Source/WebCore/html/HTMLSelectElement.cpp 2021-04-24 07:41:54 UTC (rev 276547)
@@ -655,6 +655,7 @@
downcast<HTMLOptionElement>(element).setSelectedState(m_cachedStateForActiveSelection[i]);
}
+ invalidateSelectedItems();
scrollToSelection();
updateValidity();
}
@@ -881,6 +882,7 @@
downcast<HTMLOptionElement>(*element).setSelectedState(true);
}
+ invalidateSelectedItems();
updateValidity();
// For the menu list case, this is what makes the selected element appear.
@@ -962,6 +964,7 @@
if (element != excludeElement && is<HTMLOptionElement>(*element))
downcast<HTMLOptionElement>(*element).setSelectedState(false);
}
+ invalidateSelectedItems();
}
FormControlState HTMLSelectElement::saveFormControlState() const
@@ -1027,6 +1030,7 @@
}
}
+ invalidateSelectedItems();
setOptionsChangedOnRenderer();
updateValidity();
}
@@ -1085,6 +1089,7 @@
if (!selectedOption && firstOption && !m_multiple && m_size <= 1)
firstOption->setSelectedState(true);
+ invalidateSelectedItems();
setOptionsChangedOnRenderer();
invalidateStyleForSubtree();
updateValidity();
@@ -1321,6 +1326,7 @@
if (m_activeSelectionAnchorIndex < 0 || !shiftSelect)
setActiveSelectionAnchorIndex(listIndex);
+ invalidateSelectedItems();
setActiveSelectionEndIndex(listIndex);
updateListBoxSelection(!multiSelect);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
