Changeset 242749 in webkit

Timestamp:

Mar 11, 2019, 3:46:32 PM (7 years ago)

Author:

Wenson Hsieh

Message:

[macOS] Dispatching reentrant "contextmenu" events may cause crashes
​https://bugs.webkit.org/show_bug.cgi?id=195571
<rdar://problem/48086046>

Reviewed by Andy Estes.

Source/WebCore:

Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
a result of handling a context menu event.

Test: fast/events/contextmenu-reentrancy-crash.html

• page/ContextMenuController.cpp:

(WebCore::ContextMenuController::handleContextMenuEvent):

• page/ContextMenuController.h:

LayoutTests:

Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.

• fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
• fast/events/contextmenu-reentrancy-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/contextmenu-reentrancy-crash-expected.txt (added)
• LayoutTests/fast/events/contextmenu-reentrancy-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/ContextMenuController.cpp (modified) (2 diffs)
• Source/WebCore/page/ContextMenuController.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-11  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+        https://bugs.webkit.org/show_bug.cgi?id=195571
+        <rdar://problem/48086046>
+
+        Reviewed by Andy Estes.
+
+        Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+
+        * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+        * fast/events/contextmenu-reentrancy-crash.html: Added.
+
 2019-03-11  Truitt Savell  <tsavell@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-11  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+        https://bugs.webkit.org/show_bug.cgi?id=195571
+        <rdar://problem/48086046>
+
+        Reviewed by Andy Estes.
+
+        Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+        As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+        synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+        a result of handling a context menu event.
+
+        Test: fast/events/contextmenu-reentrancy-crash.html
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        * page/ContextMenuController.h:
+
 2019-03-11  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebCore/page/ContextMenuController.cpp

@@ -69 +69 @@
 #include "WindowFeatures.h"
 #include "markup.h"
+#include <wtf/SetForScope.h>
 #include <wtf/WallTime.h>
 #include <wtf/unicode/CharacterNames.h>
@@ -98 +99 @@
 void ContextMenuController::handleContextMenuEvent(Event& event)
 {
+    if (m_isHandlingContextMenuEvent)
+        return;
+
+    SetForScope<bool> isHandlingContextMenuEventForScope(m_isHandlingContextMenuEvent, true);
+
     m_contextMenu = maybeCreateContextMenu(event);
     if (!m_contextMenu)

trunk/Source/WebCore/page/ContextMenuController.h

@@ -94 +94 @@
     RefPtr<ContextMenuProvider> m_menuProvider;
     ContextMenuContext m_context;
+    bool m_isHandlingContextMenuEvent { false };
 };