Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e7237c0f884c4215715f8dd9901155d986525ea8
https://github.com/WebKit/WebKit/commit/e7237c0f884c4215715f8dd9901155d986525ea8
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
M Source/WebCore/editing/EditorCommand.cpp
Log Message:
-----------
Editor::Command::execute() re-entrancy check is a permanent tautology, no
longer detects frame changes during layout
https://bugs.webkit.org/show_bug.cgi?id=320192
rdar://183139946
Reviewed by Chris Dumez.
Editor::Command::execute() calls updateLayoutIgnorePendingStylesheets(),
which can run arbitrary script and detach or reparent m_document. The
code was meant to guard against this by comparing the frame before and
after the layout call, bailing out if it changed.
However, Command::frame() is just a live forwarding accessor for
m_document->frame(). execute() called it once after the layout call
and compared it against another read of m_document->frame() taken
immediately after, with nothing in between able to change the result.
The check was `X != X`, which can never be true, so the guard never
fired.
This regressed in 289096@main, which removed the m_frame member
captured at Command construction time and replaced it with
Command::frame(), collapsing both sides of the comparison into
back-to-back reads of the same live value.
Fix this by capturing the frame before calling
updateLayoutIgnorePendingStylesheets(), so the comparison actually
reflects state before vs. after the potentially script-running call.
No new tests: the restored guard is only observably different from the
current code when the document's frame changes from one live frame to a
different live frame across the layout call. Document::observeFrame() is
the only mutator of that value, and it only ever goes frame <-> null
(attachToCachedFrame/detachFromCachedFrame/detachFromFrame), never frame
A -> frame B. A null starting frame cannot reach the layout call at all,
since both Command::isEnabled() and Command::allowExecutionWhenDisabled()
return false without a frame. That leaves frame -> null as the only
reachable change, and the following `if (!frame)` check already returned
false for it. The fix restores the guard's intent rather than changing
behavior for any reachable state.
* Source/WebCore/editing/EditorCommand.cpp:
(WebCore::Editor::Command::execute const):
Canonical link: https://commits.webkit.org/317966@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
