Changeset 230513 in webkit
- Timestamp:
- Apr 10, 2018 8:44:00 PM (6 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r230510 r230513 1 2018-04-10 Wenson Hsieh <wenson_hsieh@apple.com> 2 3 FrameSelection::appearanceUpdateTimerFired should be robust against layout passes underneath it 4 https://bugs.webkit.org/show_bug.cgi?id=183395 5 <rdar://problem/38055732> 6 7 Reviewed by Zalan Bujtas. 8 9 Add a new layout test that passes if we didn't crash. 10 11 * editing/selection/iframe-update-selection-appearance-expected.txt: Added. 12 * editing/selection/iframe-update-selection-appearance.html: Added. 13 1 14 2018-04-10 Nan Wang <n_wang@apple.com> 2 15 -
trunk/Source/WebCore/ChangeLog
r230512 r230513 1 2018-04-10 Wenson Hsieh <wenson_hsieh@apple.com> 2 3 FrameSelection::appearanceUpdateTimerFired should be robust against layout passes underneath it 4 https://bugs.webkit.org/show_bug.cgi?id=183395 5 <rdar://problem/38055732> 6 7 Reviewed by Zalan Bujtas. 8 9 In the case where a FrameSelection updates its appearance when m_appearanceUpdateTimer is fired, the 10 FrameSelection's Frame is unprotected, and can be removed by arbitrary script. This patch applies a simple 11 mitigation by wrapping the Frame in a Ref when firing the appearance update timer. 12 13 Test: editing/selection/iframe-update-selection-appearance.html 14 15 * editing/FrameSelection.cpp: 16 (WebCore::FrameSelection::appearanceUpdateTimerFired): 17 1 18 2018-04-10 Brent Fulgham <bfulgham@apple.com> 2 19 -
trunk/Source/WebCore/editing/FrameSelection.cpp
r230089 r230513 2442 2442 void FrameSelection::appearanceUpdateTimerFired() 2443 2443 { 2444 Ref<Frame> protectedFrame(*m_frame); 2444 2445 updateAppearanceAfterLayoutOrStyleChange(); 2445 2446 }
Note: See TracChangeset
for help on using the changeset viewer.