Title: [185838] trunk
- Revision
- 185838
- Author
- [email protected]
- Date
- 2015-06-22 12:35:19 -0700 (Mon, 22 Jun 2015)
Log Message
REGRESSION(r169105) Dangling renderer pointer in SelectionSubtreeRoot::SelectionSubtreeData.
https://bugs.webkit.org/show_bug.cgi?id=146116
rdar://problem/20959369
Reviewed by Brent Fulgham.
This patch ensures that we don't adjust the selection unless the visual selection still matches this subtree root.
When multiple selection roots are present we need to ensure that a RenderObject
only shows up in one of them.
RenderView::splitSelectionBetweenSubtrees(), as the name implies, splits the
selection and sets the selection range (start/end) on each selection root.
However, SelectionSubtreeRoot::adjustForVisibleSelection() later recomputes the range
based on visible selection and that could end up collecting renderers as selection start/end
from another selection subtree.
RenderObject's holds the last selection state (RenderObject::setSelectionState).
If we set a renderer first as "on selection border" and later "inside" using multiple selection roots,
we can't clean up selections properly when this object gets destroyed.
One of the roots ends up with a dangling RenderObject pointer.
Source/WebCore:
Test: fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html
* rendering/SelectionSubtreeRoot.cpp:
(WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
LayoutTests:
* fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees-expected.txt: Added.
* fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (185837 => 185838)
--- trunk/LayoutTests/ChangeLog 2015-06-22 19:30:46 UTC (rev 185837)
+++ trunk/LayoutTests/ChangeLog 2015-06-22 19:35:19 UTC (rev 185838)
@@ -1,3 +1,28 @@
+2015-06-22 Zalan Bujtas <[email protected]>
+
+ REGRESSION(r169105) Dangling renderer pointer in SelectionSubtreeRoot::SelectionSubtreeData.
+ https://bugs.webkit.org/show_bug.cgi?id=146116
+ rdar://problem/20959369
+
+ Reviewed by Brent Fulgham.
+
+ This patch ensures that we don't adjust the selection unless the visual selection still matches this subtree root.
+
+ When multiple selection roots are present we need to ensure that a RenderObject
+ only shows up in one of them.
+ RenderView::splitSelectionBetweenSubtrees(), as the name implies, splits the
+ selection and sets the selection range (start/end) on each selection root.
+ However, SelectionSubtreeRoot::adjustForVisibleSelection() later recomputes the range
+ based on visible selection and that could end up collecting renderers as selection start/end
+ from another selection subtree.
+ RenderObject's holds the last selection state (RenderObject::setSelectionState).
+ If we set a renderer first as "on selection border" and later "inside" using multiple selection roots,
+ we can't clean up selections properly when this object gets destroyed.
+ One of the roots ends up with a dangling RenderObject pointer.
+
+ * fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees-expected.txt: Added.
+ * fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html: Added.
+
2015-06-22 Daniel Bates <[email protected]>
AX: UI Automation cannot find AutoFill or search cancel buttons
Added: trunk/LayoutTests/fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees-expected.txt (0 => 185838)
--- trunk/LayoutTests/fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees-expected.txt 2015-06-22 19:35:19 UTC (rev 185838)
@@ -0,0 +1,4 @@
+foo
+Pass if no crash or assert in debug.
+foobar
+
Added: trunk/LayoutTests/fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html (0 => 185838)
--- trunk/LayoutTests/fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html (rev 0)
+++ trunk/LayoutTests/fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html 2015-06-22 19:35:19 UTC (rev 185838)
@@ -0,0 +1,19 @@
+<html id="webtest0">
+<head>
+<style>
+ :last-child { -webkit-flow-into: foo; }
+</style>
+
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ document.write("foo<br>");
+</script>
+</head>
+<body>Pass if no crash or assert in debug.<summary id="webtest5"><mathml><femerge></femerge></mathml>foobar<table></table></summary></body>
+<script>
+document.querySelector("#webtest0").appendChild(document.createElement("canvas"));
+document.execCommand("SelectAll");
+document.getElementById("webtest5").appendChild(document.createElement("feconvolvematrix"));
+</script>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (185837 => 185838)
--- trunk/Source/WebCore/ChangeLog 2015-06-22 19:30:46 UTC (rev 185837)
+++ trunk/Source/WebCore/ChangeLog 2015-06-22 19:35:19 UTC (rev 185838)
@@ -1,3 +1,30 @@
+2015-06-22 Zalan Bujtas <[email protected]>
+
+ REGRESSION(r169105) Dangling renderer pointer in SelectionSubtreeRoot::SelectionSubtreeData.
+ https://bugs.webkit.org/show_bug.cgi?id=146116
+ rdar://problem/20959369
+
+ Reviewed by Brent Fulgham.
+
+ This patch ensures that we don't adjust the selection unless the visual selection still matches this subtree root.
+
+ When multiple selection roots are present we need to ensure that a RenderObject
+ only shows up in one of them.
+ RenderView::splitSelectionBetweenSubtrees(), as the name implies, splits the
+ selection and sets the selection range (start/end) on each selection root.
+ However, SelectionSubtreeRoot::adjustForVisibleSelection() later recomputes the range
+ based on visible selection and that could end up collecting renderers as selection start/end
+ from another selection subtree.
+ RenderObject's holds the last selection state (RenderObject::setSelectionState).
+ If we set a renderer first as "on selection border" and later "inside" using multiple selection roots,
+ we can't clean up selections properly when this object gets destroyed.
+ One of the roots ends up with a dangling RenderObject pointer.
+
+ Test: fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees.html
+
+ * rendering/SelectionSubtreeRoot.cpp:
+ (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
+
2015-06-22 Jeremy Jones <[email protected]>
Do not exit fullscreen when starting PiP since this is done automatically.
Modified: trunk/Source/WebCore/rendering/SelectionSubtreeRoot.cpp (185837 => 185838)
--- trunk/Source/WebCore/rendering/SelectionSubtreeRoot.cpp 2015-06-22 19:30:46 UTC (rev 185837)
+++ trunk/Source/WebCore/rendering/SelectionSubtreeRoot.cpp 2015-06-22 19:35:19 UTC (rev 185838)
@@ -70,15 +70,22 @@
m_selectionSubtreeData.clearSelection();
- if (startPos.isNotNull()
- && endPos.isNotNull()
- && selection.visibleStart() != selection.visibleEnd()
- && startPos.deprecatedNode()->renderer()->flowThreadContainingBlock() == endPos.deprecatedNode()->renderer()->flowThreadContainingBlock()) {
- m_selectionSubtreeData.setSelectionStart(startPos.deprecatedNode()->renderer());
- m_selectionSubtreeData.setSelectionStartPos(startPos.deprecatedEditingOffset());
- m_selectionSubtreeData.setSelectionEnd(endPos.deprecatedNode()->renderer());
- m_selectionSubtreeData.setSelectionEndPos(endPos.deprecatedEditingOffset());
- }
+ if (startPos.isNull() || endPos.isNull())
+ return;
+
+ if (selection.visibleStart() == selection.visibleEnd())
+ return;
+
+ if (startPos.deprecatedNode()->renderer()->flowThreadContainingBlock() != endPos.deprecatedNode()->renderer()->flowThreadContainingBlock())
+ return;
+
+ if (&startPos.deprecatedNode()->renderer()->selectionRoot() != this)
+ return;
+
+ m_selectionSubtreeData.setSelectionStart(startPos.deprecatedNode()->renderer());
+ m_selectionSubtreeData.setSelectionStartPos(startPos.deprecatedEditingOffset());
+ m_selectionSubtreeData.setSelectionEnd(endPos.deprecatedNode()->renderer());
+ m_selectionSubtreeData.setSelectionEndPos(endPos.deprecatedEditingOffset());
}
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
