Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d7904663aaea57313abe6c909cd55bbc32ba6a82
https://github.com/WebKit/WebKit/commit/d7904663aaea57313abe6c909cd55bbc32ba6a82
Author: Megan Gardner <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M Source/WebCore/page/writing-tools/WritingToolsController.mm
M Source/WebKit/UIProcess/Cocoa/PlatformWritingToolsUtilities.mm
Log Message:
-----------
StabilityTracer: Safari crashes in AppKit when Writing Tools requests the
selected text with a range that exceeds the context text
https://bugs.webkit.org/show_bug.cgi?id=320609
rdar://182941183
Reviewed by Abrar Rahman Protyasha.
AppKit's Siri affordance asks the web view for its selected text, then does
substringWithRange: on the context we hand back —
so if the range doesn't fit the text, it throws and takes down Safari. We build
that pair from two separate TextIterator walks,
and the session-less path the affordance uses returned without ever checking
that the range fits. Now we clamp it in the controller
and again in convertToPlatformContext, so nothing coming over IPC can throw
inside AppKit.
No test, as the invalid range isn't reproducible from a test page — every
selection a test can construct is kept valid by VisibleSelection::validate.
* Source/WebCore/page/writing-tools/WritingToolsController.mm:
(WebCore::rangeClampedToLength):
(WebCore::WritingToolsController::willBeginWritingToolsSession):
* Source/WebKit/UIProcess/Cocoa/PlatformWritingToolsUtilities.mm:
(WebKit::convertToPlatformContext):
Canonical link: https://commits.webkit.org/318271@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
