Changeset 242861 in webkit

Timestamp:

Mar 13, 2019, 1:24:54 AM (7 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r242749. rdar://problem/48839358

[macOS] Dispatching reentrant "contextmenu" events may cause crashes
​https://bugs.webkit.org/show_bug.cgi?id=195571
<rdar://problem/48086046>

Reviewed by Andy Estes.

Source/WebCore:

Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
a result of handling a context menu event.

Test: fast/events/contextmenu-reentrancy-crash.html

• page/ContextMenuController.cpp: (WebCore::ContextMenuController::handleContextMenuEvent):
• page/ContextMenuController.h:

LayoutTests:

Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.

• fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
• fast/events/contextmenu-reentrancy-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242749 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/contextmenu-reentrancy-crash-expected.txt (added)
• LayoutTests/fast/events/contextmenu-reentrancy-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/ContextMenuController.cpp (modified) (2 diffs)
• Source/WebCore/page/ContextMenuController.h (modified) (1 diff)

branches/safari-607-branch/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242749. rdar://problem/48839358
+
+    [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+    https://bugs.webkit.org/show_bug.cgi?id=195571
+    <rdar://problem/48086046>
+    
+    Reviewed by Andy Estes.
+    
+    Source/WebCore:
+    
+    Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+    As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+    synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+    a result of handling a context menu event.
+    
+    Test: fast/events/contextmenu-reentrancy-crash.html
+    
+    * page/ContextMenuController.cpp:
+    (WebCore::ContextMenuController::handleContextMenuEvent):
+    * page/ContextMenuController.h:
+    
+    LayoutTests:
+    
+    Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+    
+    * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+    * fast/events/contextmenu-reentrancy-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-11  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+            [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+            https://bugs.webkit.org/show_bug.cgi?id=195571
+            <rdar://problem/48086046>
+
+            Reviewed by Andy Estes.
+
+            Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+
+            * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+            * fast/events/contextmenu-reentrancy-crash.html: Added.
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242749. rdar://problem/48839358
+
+    [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+    https://bugs.webkit.org/show_bug.cgi?id=195571
+    <rdar://problem/48086046>
+    
+    Reviewed by Andy Estes.
+    
+    Source/WebCore:
+    
+    Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+    As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+    synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+    a result of handling a context menu event.
+    
+    Test: fast/events/contextmenu-reentrancy-crash.html
+    
+    * page/ContextMenuController.cpp:
+    (WebCore::ContextMenuController::handleContextMenuEvent):
+    * page/ContextMenuController.h:
+    
+    LayoutTests:
+    
+    Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+    
+    * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+    * fast/events/contextmenu-reentrancy-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-11  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+            [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+            https://bugs.webkit.org/show_bug.cgi?id=195571
+            <rdar://problem/48086046>
+
+            Reviewed by Andy Estes.
+
+            Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+            As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+            synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+            a result of handling a context menu event.
+
+            Test: fast/events/contextmenu-reentrancy-crash.html
+
+            * page/ContextMenuController.cpp:
+            (WebCore::ContextMenuController::handleContextMenuEvent):
+            * page/ContextMenuController.h:
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/WebCore/page/ContextMenuController.cpp

@@ -69 +69 @@
 #include "WindowFeatures.h"
 #include "markup.h"
+#include <wtf/SetForScope.h>
 #include <wtf/WallTime.h>
 #include <wtf/unicode/CharacterNames.h>
@@ -98 +99 @@
 void ContextMenuController::handleContextMenuEvent(Event& event)
 {
+    if (m_isHandlingContextMenuEvent)
+        return;
+
+    SetForScope<bool> isHandlingContextMenuEventForScope(m_isHandlingContextMenuEvent, true);
+
     m_contextMenu = maybeCreateContextMenu(event);
     if (!m_contextMenu)

branches/safari-607-branch/Source/WebCore/page/ContextMenuController.h

@@ -94 +94 @@
     RefPtr<ContextMenuProvider> m_menuProvider;
     ContextMenuContext m_context;
+    bool m_isHandlingContextMenuEvent { false };
 };