Changeset 242587 in webkit

Timestamp:

Mar 6, 2019, 7:11:38 PM (7 years ago)

Author:

Wenson Hsieh

Message:

Crash when attempting to change input type while dismissing datalist suggestions
​https://bugs.webkit.org/show_bug.cgi?id=195384
<rdar://problem/48563718>

Reviewed by Brent Fulgham.

Source/WebCore:

When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
reference its active datalist suggestions picker.

Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html

• platform/DataListSuggestionPicker.h:

Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).

Source/WebKit:

See WebCore ChangeLog for more details.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::setActiveDataListSuggestionPicker):
(WebKit::WebPage::didSelectDataListOption):
(WebKit::WebPage::didCloseSuggestions):

• WebProcess/WebPage/WebPage.h:

Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.

LayoutTests:

Add a new layout test to exercise this scenario.

• fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
• fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt (added)
• LayoutTests/fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/DataListSuggestionPicker.h (modified) (1 diff)
• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/WebProcess/WebPage/WebPage.cpp (modified) (1 diff)
• Source/WebKit/WebProcess/WebPage/WebPage.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-06  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Crash when attempting to change input type while dismissing datalist suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=195384
+        <rdar://problem/48563718>
+
+        Reviewed by Brent Fulgham.
+
+        Add a new layout test to exercise this scenario.
+
+        * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions-expected.txt: Added.
+        * fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html: Added.
+
 2019-03-06  Justin Fan  <justin_fan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-06  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Crash when attempting to change input type while dismissing datalist suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=195384
+        <rdar://problem/48563718>
+
+        Reviewed by Brent Fulgham.
+
+        When closing a datalist suggestion menu, WebPageProxy sends a message to WebPage instructing it to tell its
+        active datalist suggestions picker to close. However, for a myriad of reasons, the suggestions picker (kept
+        alive by its text input type) may have already gone away by this point. To mitigate this, make WebPage weakly
+        reference its active datalist suggestions picker.
+
+        Test: fast/forms/datalist/change-input-type-after-closing-datalist-suggestions.html
+
+        * platform/DataListSuggestionPicker.h:
+
+        Make DataListSuggestionPicker capable of being weakly referenced. Additionally, fix some minor preexisting
+        issues in this header (#imports instead of #includes, as well as an unnecessary include of IntRect.h).
+
 2019-03-06  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/platform/DataListSuggestionPicker.h

@@ -28 +28 @@
 #if ENABLE(DATALIST_ELEMENT)
 
-#import "DataListSuggestionInformation.h"
-#import "IntRect.h"
-
-#import <wtf/text/WTFString.h>
+#include "DataListSuggestionInformation.h"
+#include <wtf/WeakPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-class DataListSuggestionPicker {
+class DataListSuggestionPicker : public CanMakeWeakPtr<DataListSuggestionPicker> {
     WTF_MAKE_FAST_ALLOCATED;
 public:

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-03-06  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Crash when attempting to change input type while dismissing datalist suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=195384
+        <rdar://problem/48563718>
+
+        Reviewed by Brent Fulgham.
+
+        See WebCore ChangeLog for more details.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setActiveDataListSuggestionPicker):
+        (WebKit::WebPage::didSelectDataListOption):
+        (WebKit::WebPage::didCloseSuggestions):
+        * WebProcess/WebPage/WebPage.h:
+
+        Turn m_activeDataListSuggestionPicker from a raw pointer into a WeakPtr.
+
 2019-03-06  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

@@ -3900 +3900 @@
 void WebPage::setActiveDataListSuggestionPicker(WebDataListSuggestionPicker* dataListSuggestionPicker)
 {
-    m_activeDataListSuggestionPicker = dataListSuggestionPicker;
+    m_activeDataListSuggestionPicker = makeWeakPtr(dataListSuggestionPicker);
 }
 
 void WebPage::didSelectDataListOption(const String& selectedOption)
 {
-    m_activeDataListSuggestionPicker->didSelectOption(selectedOption);
+    if (m_activeDataListSuggestionPicker)
+        m_activeDataListSuggestionPicker->didSelectOption(selectedOption);
 }
 
 void WebPage::didCloseSuggestions()
 {
-    if (m_activeDataListSuggestionPicker)
-        m_activeDataListSuggestionPicker->didCloseSuggestions();
-    m_activeDataListSuggestionPicker = nullptr;
+    if (auto picker = std::exchange(m_activeDataListSuggestionPicker, nullptr))
+        picker->didCloseSuggestions();
 }
 

trunk/Source/WebKit/WebProcess/WebPage/WebPage.h

@@ -1658 +1658 @@
 
 #if ENABLE(DATALIST_ELEMENT)
-    WebDataListSuggestionPicker* m_activeDataListSuggestionPicker { nullptr };
+    WeakPtr<WebDataListSuggestionPicker> m_activeDataListSuggestionPicker;
 #endif