Title: [286049] trunk
- Revision
- 286049
- Author
- [email protected]
- Date
- 2021-11-18 23:30:40 -0800 (Thu, 18 Nov 2021)
Log Message
Nullptr crash in SimplifiedBackwardsTextIterator::range() via previousSentencePosition
https://bugs.webkit.org/show_bug.cgi?id=229282
Patch by Frédéric Wang <[email protected]> on 2021-11-18
Reviewed by Darin Adler.
Source/WebCore:
Constructors of TextIterator and SimplifiedBackwardsTextIterator update layout, which may
make HTMLObjectElement switch to fallback content and invalidate their renderer. As a
consequence their advance() method may incorrectly treat them as replaced elements. This
patch updates the layout at the beginning of FrameSelection::modify and disable post
resolution callbacks in order to prevent this kind of unaverted tree changes while browsing
the tree for selection update.
Test: editing/text-iterator/backward-textiterator-object-crash.html
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::modify): Update layout and disable post resolution callback, so that
all iterators used during the execution of the function handle <object>s consistently.
LayoutTests:
Add regression test.
* editing/text-iterator/backward-textiterator-object-crash-expected.txt: Added.
* editing/text-iterator/backward-textiterator-object-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (286048 => 286049)
--- trunk/LayoutTests/ChangeLog 2021-11-19 07:27:51 UTC (rev 286048)
+++ trunk/LayoutTests/ChangeLog 2021-11-19 07:30:40 UTC (rev 286049)
@@ -1,3 +1,15 @@
+2021-11-18 Frédéric Wang <[email protected]>
+
+ Nullptr crash in SimplifiedBackwardsTextIterator::range() via previousSentencePosition
+ https://bugs.webkit.org/show_bug.cgi?id=229282
+
+ Reviewed by Darin Adler.
+
+ Add regression test.
+
+ * editing/text-iterator/backward-textiterator-object-crash-expected.txt: Added.
+ * editing/text-iterator/backward-textiterator-object-crash.html: Added.
+
2021-11-18 Ben Nham <[email protected]>
Add support for onpushsubscriptionchange event handler
Added: trunk/LayoutTests/editing/text-iterator/backward-textiterator-object-crash-expected.txt (0 => 286049)
--- trunk/LayoutTests/editing/text-iterator/backward-textiterator-object-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/text-iterator/backward-textiterator-object-crash-expected.txt 2021-11-19 07:30:40 UTC (rev 286049)
@@ -0,0 +1 @@
+This test passes if it does not crash.
Added: trunk/LayoutTests/editing/text-iterator/backward-textiterator-object-crash.html (0 => 286049)
--- trunk/LayoutTests/editing/text-iterator/backward-textiterator-object-crash.html (rev 0)
+++ trunk/LayoutTests/editing/text-iterator/backward-textiterator-object-crash.html 2021-11-19 07:30:40 UTC (rev 286049)
@@ -0,0 +1,13 @@
+<script>
+ _onload_ = () => {
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ document.documentElement.removeChild(document.head);
+ let input = document.createElement('input');
+ document.documentElement.appendChild(input);
+ getSelection().setBaseAndExtent(input, 0, input, 0);
+ document.body.innerHTML = "<object><object><object><object><div></div></object></object></object></object>";
+ getSelection().modify('move', 'backward', 'sentence');
+ document.body.innerHTML = "This test passes if it does not crash.";
+ };
+</script>
Modified: trunk/Source/WebCore/ChangeLog (286048 => 286049)
--- trunk/Source/WebCore/ChangeLog 2021-11-19 07:27:51 UTC (rev 286048)
+++ trunk/Source/WebCore/ChangeLog 2021-11-19 07:30:40 UTC (rev 286049)
@@ -1,3 +1,23 @@
+2021-11-18 Frédéric Wang <[email protected]>
+
+ Nullptr crash in SimplifiedBackwardsTextIterator::range() via previousSentencePosition
+ https://bugs.webkit.org/show_bug.cgi?id=229282
+
+ Reviewed by Darin Adler.
+
+ Constructors of TextIterator and SimplifiedBackwardsTextIterator update layout, which may
+ make HTMLObjectElement switch to fallback content and invalidate their renderer. As a
+ consequence their advance() method may incorrectly treat them as replaced elements. This
+ patch updates the layout at the beginning of FrameSelection::modify and disable post
+ resolution callbacks in order to prevent this kind of unaverted tree changes while browsing
+ the tree for selection update.
+
+ Test: editing/text-iterator/backward-textiterator-object-crash.html
+
+ * editing/FrameSelection.cpp:
+ (WebCore::FrameSelection::modify): Update layout and disable post resolution callback, so that
+ all iterators used during the execution of the function handle <object>s consistently.
+
2021-11-18 Antoine Quint <[email protected]>
[Model] add support for pausing and resuming animations
Modified: trunk/Source/WebCore/editing/FrameSelection.cpp (286048 => 286049)
--- trunk/Source/WebCore/editing/FrameSelection.cpp 2021-11-19 07:27:51 UTC (rev 286048)
+++ trunk/Source/WebCore/editing/FrameSelection.cpp 2021-11-19 07:30:40 UTC (rev 286049)
@@ -71,6 +71,7 @@
#include "SimpleRange.h"
#include "SpatialNavigation.h"
#include "StyleProperties.h"
+#include "StyleTreeResolver.h"
#include "TypingCommand.h"
#include "VisibleUnits.h"
#include <stdio.h>
@@ -1344,6 +1345,14 @@
willBeModified(alter, direction);
+ // Before modifying selection, update layout and disable post resolution callbacks.
+ // That way, unaverted tree changes are avoided while browsing the document.
+ auto selectionDocument = m_selection.document();
+ if (!selectionDocument)
+ return false;
+ selectionDocument->updateLayoutIgnorePendingStylesheets();
+ Style::PostResolutionCallbackDisabler disabler(*selectionDocument);
+
bool reachedBoundary = false;
bool wasRange = m_selection.isRange();
Position originalStartPosition = m_selection.start();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
