Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b72851e83e5aec900b8d6a49d6be0614e3e6f586
https://github.com/WebKit/WebKit/commit/b72851e83e5aec900b8d6a49d6be0614e3e6f586
Author: Wenson Hsieh <[email protected]>
Date: 2023-07-06 (Thu, 06 Jul 2023)
Changed paths:
M Source/WebCore/editing/Editor.cpp
M Source/WebCore/loader/EmptyClients.cpp
M Source/WebCore/page/EditorClient.h
M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.h
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebPage/WebPage.h
M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.h
M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm
M Tools/TestWebKitAPI/Tests/ios/KeyboardInputTestsIOS.mm
Log Message:
-----------
Occasional crash under WebPage::sendEditorStateUpdate() when discarding IME
composition
https://bugs.webkit.org/show_bug.cgi?id=258942
rdar://111258989
Reviewed by Tim Horton.
Address a web content process crash, wherein we attempt to access
`Page::m_focusController` once it
has already been cleared out. This can occur when a page in the page cache is
destroyed, while it
still contains an active IME composition (i.e. `Editor::m_compositionNode` is
non-null).
Mitigate this by only computing and sending an editor state update in this
case, if the `Document`
containing the marked text range has a living render tree. To do this, we
refactor the
`discardedComposition` `EditorClient` hook to pass a `const Document&` instead
of a `Frame*` (the
latter of which ends up being null at this point during page destruction), and
use it to return
early in `WebPage::discardedComposition` to avoid the crash.
Test: KeyboardInputTests.NoCrashWhenDiscardingMarkedText
* Source/WebCore/editing/Editor.cpp:
(WebCore::Editor::clear):
(WebCore::Editor::confirmOrCancelCompositionAndNotifyClient):
* Source/WebCore/loader/EmptyClients.cpp:
* Source/WebCore/page/EditorClient.h:
* Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::discardedComposition):
* Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::didChangeSelectionOrOverflowScrollPosition):
(WebKit::WebPage::discardedComposition):
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.h:
* Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::discardedComposition):
* Tools/TestWebKitAPI/Tests/ios/KeyboardInputTestsIOS.mm:
(TestWebKitAPI::TEST):
Canonical link: https://commits.webkit.org/265821@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
