Title: [185827] trunk/Source/WebKit2
- Revision
- 185827
- Author
- [email protected]
- Date
- 2015-06-22 07:32:48 -0700 (Mon, 22 Jun 2015)
Log Message
Crash replacing TabDocument in MobileSafari at WebKit: -[WKWebView(WKPrivate) _beginAnimatedResizeWithUpdates:]
https://bugs.webkit.org/show_bug.cgi?id=146201
Reviewed by Dan Bernstein.
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _beginAnimatedResizeWithUpdates:]):
No repro but if for some reason [_contentView bounds] width is zero we'll compute +Inf targetScale
and then NaN contentOffset.x. Verified in lldb that this gives the exact crash signature seen.
Fix by checking that [_contentView bounds] is not empty like is done with other inputs.
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (185826 => 185827)
--- trunk/Source/WebKit2/ChangeLog 2015-06-22 13:59:08 UTC (rev 185826)
+++ trunk/Source/WebKit2/ChangeLog 2015-06-22 14:32:48 UTC (rev 185827)
@@ -1,3 +1,18 @@
+2015-06-22 Antti Koivisto <[email protected]>
+
+ Crash replacing TabDocument in MobileSafari at WebKit: -[WKWebView(WKPrivate) _beginAnimatedResizeWithUpdates:]
+ https://bugs.webkit.org/show_bug.cgi?id=146201
+
+ Reviewed by Dan Bernstein.
+
+ * UIProcess/API/Cocoa/WKWebView.mm:
+ (-[WKWebView _beginAnimatedResizeWithUpdates:]):
+
+ No repro but if for some reason [_contentView bounds] width is zero we'll compute +Inf targetScale
+ and then NaN contentOffset.x. Verified in lldb that this gives the exact crash signature seen.
+
+ Fix by checking that [_contentView bounds] is not empty like is done with other inputs.
+
2015-06-22 Carlos Garcia Campos <[email protected]>
REGRESSION(r182303): [GTK] Context menu API is broken since r182303
Modified: trunk/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm (185826 => 185827)
--- trunk/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm 2015-06-22 13:59:08 UTC (rev 185826)
+++ trunk/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm 2015-06-22 14:32:48 UTC (rev 185827)
@@ -2622,9 +2622,10 @@
int32_t newOrientation = activeOrientation(self);
UIEdgeInsets newObscuredInsets = _obscuredInsets;
CGRect futureUnobscuredRectInSelfCoordinates = UIEdgeInsetsInsetRect(newBounds, _obscuredInsets);
+ CGRect contentViewBounds = [_contentView bounds];
ASSERT_WITH_MESSAGE(!(_overridesMinimumLayoutSize && newMinimumLayoutSize.isEmpty()), "Clients controlling the layout size should maintain a valid layout size to minimize layouts.");
- if (CGRectIsEmpty(newBounds) || newMinimumLayoutSize.isEmpty() || CGRectIsEmpty(futureUnobscuredRectInSelfCoordinates)) {
+ if (CGRectIsEmpty(newBounds) || newMinimumLayoutSize.isEmpty() || CGRectIsEmpty(futureUnobscuredRectInSelfCoordinates) || CGRectIsEmpty(contentViewBounds)) {
_dynamicViewportUpdateMode = DynamicViewportUpdateMode::NotResizing;
[self _frameOrBoundsChanged];
if (_overridesMinimumLayoutSize)
@@ -2655,7 +2656,7 @@
[_resizeAnimationView addSubview:_contentView.get()];
[_resizeAnimationView addSubview:[_contentView unscaledView]];
- CGSize contentSizeInContentViewCoordinates = [_contentView bounds].size;
+ CGSize contentSizeInContentViewCoordinates = contentViewBounds.size;
[_scrollView setMinimumZoomScale:std::min(newMinimumLayoutSize.width() / contentSizeInContentViewCoordinates.width, [_scrollView minimumZoomScale])];
[_scrollView setMaximumZoomScale:std::max(newMinimumLayoutSize.width() / contentSizeInContentViewCoordinates.width, [_scrollView maximumZoomScale])];
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
