Changeset 243249 in webkit

Timestamp:

Mar 20, 2019, 3:49:44 PM (7 years ago)

Author:

dino@apple.com

Message:

[iOS] Crash in WebCore::Node::renderRect
​https://bugs.webkit.org/show_bug.cgi?id=196035
<rdar://problem/49076783>

Reviewed by Antoine Quint.

When renderRect was called on an HTMLAreaElement, it would
ASSERT because it doesn't have a renderer. We hadn't noticed
this before because none of our tests were hitting this in
debug mode.

The fix is to ask the corresponding HTMLImageElement for
its renderer, and use that for the returned rectangle.

Covered by these tests that had become flakey:

fast/images/imagemap-in-shadow-tree.html
http/tests/download/area-download.html

• dom/Node.cpp:

(WebCore::Node::renderRect):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Node.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-20  Dean Jackson  <dino@apple.com>
+
+        [iOS] Crash in WebCore::Node::renderRect
+        https://bugs.webkit.org/show_bug.cgi?id=196035
+        <rdar://problem/49076783>
+
+        Reviewed by Antoine Quint.
+
+        When renderRect was called on an HTMLAreaElement, it would
+        ASSERT because it doesn't have a renderer. We hadn't noticed
+        this before because none of our tests were hitting this in
+        debug mode.
+
+        The fix is to ask the corresponding HTMLImageElement for
+        its renderer, and use that for the returned rectangle.
+
+        Covered by these tests that had become flakey:
+            fast/images/imagemap-in-shadow-tree.html
+            http/tests/download/area-download.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::renderRect):
+
 2019-03-20  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/dom/Node.cpp

@@ -43 +43 @@
 #include "EventHandler.h"
 #include "FrameView.h"
+#include "HTMLAreaElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCollection.h"
@@ -796 +797 @@
 {    
     RenderObject* hitRenderer = this->renderer();
-    ASSERT(hitRenderer);
+    if (!hitRenderer && is<HTMLAreaElement>(*this)) {
+        auto& area = downcast<HTMLAreaElement>(*this);
+        if (auto* imageElement = area.imageElement())
+            hitRenderer = imageElement->renderer();
+    }
     RenderObject* renderer = hitRenderer;
     while (renderer && !renderer->isBody() && !renderer->isDocumentElementRenderer()) {