⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 243724 in webkit


Ignore:
Timestamp:
Apr 1, 2019, 4:54:18 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r243684. rdar://problem/49454962

[iOS] Crash when changing inputmode for certain types of focusable elements
​https://bugs.webkit.org/show_bug.cgi?id=196431
<rdar://problem/49454962>

Reviewed by Tim Horton.

Source/WebKit:

The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
is only set for certain types of elements that require user input (e.g. text fields, editable content, select
menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
focused element doesn't fall into one of the aforementioned categories.

To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
element. See below for more details.

Test: fast/forms/change-inputmode-crash.html

  • WebProcess/WebPage/WebPage.cpp: (WebKit::isTextFormControlOrEditableContent):

Clean up some existing logic by introducing a helper method for determining whether an element should
propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
of checking against the tag name.

(WebKit::WebPage::elementDidFocus):
(WebKit::WebPage::focusedElementDidChangeInputMode):

LayoutTests:

Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.

  • fast/forms/change-inputmode-crash-expected.txt: Added.
  • fast/forms/change-inputmode-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243684 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
tags/Safari-608.1.13.4
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • tags/Safari-608.1.13.4/LayoutTests/ChangeLog

    r243723 r243724  
     12019-04-01  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r243684. rdar://problem/49454962
     4
     5    [iOS] Crash when changing inputmode for certain types of focusable elements
     6    https://bugs.webkit.org/show_bug.cgi?id=196431
     7    <rdar://problem/49454962>
     8   
     9    Reviewed by Tim Horton.
     10   
     11    Source/WebKit:
     12   
     13    The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
     14    element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
     15    is only set for certain types of elements that require user input (e.g. text fields, editable content, select
     16    menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
     17    focused element doesn't fall into one of the aforementioned categories.
     18   
     19    To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
     20    element. See below for more details.
     21   
     22    Test: fast/forms/change-inputmode-crash.html
     23   
     24    * WebProcess/WebPage/WebPage.cpp:
     25    (WebKit::isTextFormControlOrEditableContent):
     26   
     27    Clean up some existing logic by introducing a helper method for determining whether an element should
     28    propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
     29    of checking against the tag name.
     30   
     31    (WebKit::WebPage::elementDidFocus):
     32    (WebKit::WebPage::focusedElementDidChangeInputMode):
     33   
     34    LayoutTests:
     35   
     36    Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
     37   
     38    * fast/forms/change-inputmode-crash-expected.txt: Added.
     39    * fast/forms/change-inputmode-crash.html: Added.
     40   
     41   
     42    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     43
     44    2019-03-31  Wenson Hsieh  <wenson_hsieh@apple.com>
     45
     46            [iOS] Crash when changing inputmode for certain types of focusable elements
     47            https://bugs.webkit.org/show_bug.cgi?id=196431
     48            <rdar://problem/49454962>
     49
     50            Reviewed by Tim Horton.
     51
     52            Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
     53
     54            * fast/forms/change-inputmode-crash-expected.txt: Added.
     55            * fast/forms/change-inputmode-crash.html: Added.
     56
    1572019-04-01  Alan Coon  <alancoon@apple.com>
    258

  • tags/Safari-608.1.13.4/Source/WebKit/ChangeLog

    r243723 r243724  
     12019-04-01  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r243684. rdar://problem/49454962
     4
     5    [iOS] Crash when changing inputmode for certain types of focusable elements
     6    https://bugs.webkit.org/show_bug.cgi?id=196431
     7    <rdar://problem/49454962>
     8   
     9    Reviewed by Tim Horton.
     10   
     11    Source/WebKit:
     12   
     13    The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
     14    element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
     15    is only set for certain types of elements that require user input (e.g. text fields, editable content, select
     16    menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
     17    focused element doesn't fall into one of the aforementioned categories.
     18   
     19    To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
     20    element. See below for more details.
     21   
     22    Test: fast/forms/change-inputmode-crash.html
     23   
     24    * WebProcess/WebPage/WebPage.cpp:
     25    (WebKit::isTextFormControlOrEditableContent):
     26   
     27    Clean up some existing logic by introducing a helper method for determining whether an element should
     28    propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
     29    of checking against the tag name.
     30   
     31    (WebKit::WebPage::elementDidFocus):
     32    (WebKit::WebPage::focusedElementDidChangeInputMode):
     33   
     34    LayoutTests:
     35   
     36    Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.
     37   
     38    * fast/forms/change-inputmode-crash-expected.txt: Added.
     39    * fast/forms/change-inputmode-crash.html: Added.
     40   
     41   
     42    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     43
     44    2019-03-31  Wenson Hsieh  <wenson_hsieh@apple.com>
     45
     46            [iOS] Crash when changing inputmode for certain types of focusable elements
     47            https://bugs.webkit.org/show_bug.cgi?id=196431
     48            <rdar://problem/49454962>
     49
     50            Reviewed by Tim Horton.
     51
     52            The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
     53            element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
     54            is only set for certain types of elements that require user input (e.g. text fields, editable content, select
     55            menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
     56            focused element doesn't fall into one of the aforementioned categories.
     57
     58            To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
     59            element. See below for more details.
     60
     61            Test: fast/forms/change-inputmode-crash.html
     62
     63            * WebProcess/WebPage/WebPage.cpp:
     64            (WebKit::isTextFormControlOrEditableContent):
     65
     66            Clean up some existing logic by introducing a helper method for determining whether an element should
     67            propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
     68            of checking against the tag name.
     69
     70            (WebKit::WebPage::elementDidFocus):
     71            (WebKit::WebPage::focusedElementDidChangeInputMode):
     72
    1732019-04-01  Alan Coon  <alancoon@apple.com>
    274

  • tags/Safari-608.1.13.4/Source/WebKit/WebProcess/WebPage/WebPage.cpp

    r243354 r243724  
    174174#include <WebCore/HTMLPlugInElement.h>
    175175#include <WebCore/HTMLPlugInImageElement.h>
     176#include <WebCore/HTMLSelectElement.h>
    176177#include <WebCore/HTMLTextAreaElement.h>
     178#include <WebCore/HTMLTextFormControlElement.h>
    177179#include <WebCore/HTMLUListElement.h>
    178180#include <WebCore/HistoryController.h>
    … …  
    53465348}
    53475349
     5350static bool isTextFormControlOrEditableContent(const WebCore::Element& element)
     5351{
     5352    return is<HTMLTextFormControlElement>(element) || element.hasEditableStyle();
     5353}
     5354
    53485355void WebPage::elementDidFocus(WebCore::Element& element)
    53495356{
    … …  
    53545361    }
    53555362
    5356     if (element.hasTagName(WebCore::HTMLNames::selectTag) || element.hasTagName(WebCore::HTMLNames::inputTag) || element.hasTagName(WebCore::HTMLNames::textareaTag) || element.hasEditableStyle()) {
     5363    if (is<HTMLSelectElement>(element) || isTextFormControlOrEditableContent(element)) {
    53575364        m_focusedElement = &element;
    53585365
    … …  
    54005407void WebPage::focusedElementDidChangeInputMode(WebCore::Element& element, WebCore::InputMode mode)
    54015408{
     5409    if (m_focusedElement != &element)
     5410        return;
     5411
    54025412#if PLATFORM(IOS_FAMILY)
    5403     ASSERT(m_focusedElement == &element);
    54045413    ASSERT(is<HTMLElement>(element));
    54055414    ASSERT(downcast<HTMLElement>(element).canonicalInputMode() == mode);
    54065415
    5407     if (!is<HTMLTextAreaElement>(*m_focusedElement) && !is<HTMLInputElement>(*m_focusedElement) && !m_focusedElement->hasEditableStyle())
     5416    if (!isTextFormControlOrEditableContent(element))
    54085417        return;
    54095418
    54105419    send(Messages::WebPageProxy::FocusedElementDidChangeInputMode(mode));
    54115420#else
    5412     UNUSED_PARAM(element);
    54135421    UNUSED_PARAM(mode);
    54145422#endif
Note: See TracChangeset for help on using the changeset viewer.