Title: [276742] trunk/Source
- Revision
- 276742
- Author
- [email protected]
- Date
- 2021-04-28 17:25:32 -0700 (Wed, 28 Apr 2021)
Log Message
[iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
https://bugs.webkit.org/show_bug.cgi?id=225072
rdar://77159489
Reviewed by Darin Adler.
Source/WebCore:
Remove a helper method that was added in r276688, which we no longer need.
* dom/Position.h:
(WebCore::Position::isInTreeScope const): Deleted.
Source/WebKit:
The fix for this crash that I landed in r276688 was based on a misunderstanding that accessing `treeScope()`
would trigger a null pointer deref if `isInTreeScope()` is `false`. This is not the case, since the `treeScope`
of a `Node` is a separate notion from whether that `Node` is connected to said tree scope.
Since this crash is really due to dereferencing a null container node in the case where `selectionStart` or
`selectionEnd` are null, a better fix is to just check the nullity of the container node.
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::rangeForPointInRootViewCoordinates):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (276741 => 276742)
--- trunk/Source/WebCore/ChangeLog 2021-04-29 00:17:49 UTC (rev 276741)
+++ trunk/Source/WebCore/ChangeLog 2021-04-29 00:25:32 UTC (rev 276742)
@@ -1,3 +1,16 @@
+2021-04-28 Wenson Hsieh <[email protected]>
+
+ [iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
+ https://bugs.webkit.org/show_bug.cgi?id=225072
+ rdar://77159489
+
+ Reviewed by Darin Adler.
+
+ Remove a helper method that was added in r276688, which we no longer need.
+
+ * dom/Position.h:
+ (WebCore::Position::isInTreeScope const): Deleted.
+
2021-04-28 Cameron McCormack <[email protected]>
Don't create custom scrollbars for fullscreen placeholders.
Modified: trunk/Source/WebCore/dom/Position.h (276741 => 276742)
--- trunk/Source/WebCore/dom/Position.h 2021-04-29 00:17:49 UTC (rev 276741)
+++ trunk/Source/WebCore/dom/Position.h 2021-04-29 00:25:32 UTC (rev 276742)
@@ -124,8 +124,6 @@
return container ? container->rootEditableElement() : nullptr;
}
- bool isInTreeScope() const { return m_anchorNode && m_anchorNode->isInTreeScope(); }
-
// These should only be used for PositionIsOffsetInAnchor positions, unless
// the position is a legacy editing position.
void moveToPosition(Node* anchorNode, unsigned offset);
Modified: trunk/Source/WebKit/ChangeLog (276741 => 276742)
--- trunk/Source/WebKit/ChangeLog 2021-04-29 00:17:49 UTC (rev 276741)
+++ trunk/Source/WebKit/ChangeLog 2021-04-29 00:25:32 UTC (rev 276742)
@@ -1,3 +1,21 @@
+2021-04-28 Wenson Hsieh <[email protected]>
+
+ [iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
+ https://bugs.webkit.org/show_bug.cgi?id=225072
+ rdar://77159489
+
+ Reviewed by Darin Adler.
+
+ The fix for this crash that I landed in r276688 was based on a misunderstanding that accessing `treeScope()`
+ would trigger a null pointer deref if `isInTreeScope()` is `false`. This is not the case, since the `treeScope`
+ of a `Node` is a separate notion from whether that `Node` is connected to said tree scope.
+
+ Since this crash is really due to dereferencing a null container node in the case where `selectionStart` or
+ `selectionEnd` are null, a better fix is to just check the nullity of the container node.
+
+ * WebProcess/WebPage/ios/WebPageIOS.mm:
+ (WebKit::rangeForPointInRootViewCoordinates):
+
2021-04-28 Basuke Suzuki <[email protected]>
Suppress warnings for %{private}s format specifier
Modified: trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm (276741 => 276742)
--- trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm 2021-04-29 00:17:49 UTC (rev 276741)
+++ trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm 2021-04-29 00:25:32 UTC (rev 276742)
@@ -1524,15 +1524,15 @@
if (baseIsStart) {
if (result <= selectionStart)
result = selectionStart.next();
- else if (targetNode && targetNode->isInTreeScope() && selectionStart.deepEquivalent().isInTreeScope() && selectionStart.deepEquivalent().treeScope() != &targetNode->treeScope())
- result = VisibleSelection::adjustPositionForEnd(result.deepEquivalent(), selectionStart.deepEquivalent().containerNode());
+ else if (auto containerNode = makeRefPtr(selectionStart.deepEquivalent().containerNode()); containerNode && targetNode && &containerNode->treeScope() != &targetNode->treeScope())
+ result = VisibleSelection::adjustPositionForEnd(result.deepEquivalent(), containerNode.get());
range = makeSimpleRange(selectionStart, result);
} else {
if (selectionEnd <= result)
result = selectionEnd.previous();
- else if (targetNode && targetNode->isInTreeScope() && selectionEnd.deepEquivalent().isInTreeScope() && selectionEnd.deepEquivalent().treeScope() != &targetNode->treeScope())
- result = VisibleSelection::adjustPositionForStart(result.deepEquivalent(), selectionEnd.deepEquivalent().containerNode());
+ else if (auto containerNode = makeRefPtr(selectionEnd.deepEquivalent().containerNode()); containerNode && targetNode && &containerNode->treeScope() != &targetNode->treeScope())
+ result = VisibleSelection::adjustPositionForStart(result.deepEquivalent(), containerNode.get());
range = makeSimpleRange(result, selectionEnd);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
