Changeset 245509 in webkit

Timestamp:

May 19, 2019, 8:15:30 PM (7 years ago)

Author:

Brent Fulgham

Message:

Wait to get frame until after layout has been run
​https://bugs.webkit.org/show_bug.cgi?id=197999
<rdar://problem/50800345>

Reviewed by Alex Christensen.

Source/WebCore:

The current frame can change when layout runs, so don't bother retrieving
the frame until the final layout pass is complete.

Test: fast/dom/window-inner-width-crash.html

• page/DOMWindow.cpp:

(WebCore::DOMWindow::innerHeight const): Move frame access past the
layout operation.
(WebCore::DOMWindow::innerWidth const): Ditto.
(WebCore::DOMWindow::scrollX const): Ditto.
(WebCore::DOMWindow::scrollY const): Ditto.

LayoutTests:

• fast/dom/window-inner-width-crash-expected.txt: Added.
• fast/dom/window-inner-width-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/window-inner-width-crash-expected.txt (added)
• LayoutTests/fast/dom/window-inner-width-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/DOMWindow.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-05-19  Brent Fulgham  <bfulgham@apple.com>
+
+        Wait to get frame until after layout has been run
+        https://bugs.webkit.org/show_bug.cgi?id=197999
+        <rdar://problem/50800345>
+
+        Reviewed by Alex Christensen.
+
+        * fast/dom/window-inner-width-crash-expected.txt: Added.
+        * fast/dom/window-inner-width-crash.html: Added.
+
 2019-05-19  Antoine Quint  <graouts@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-19  Brent Fulgham  <bfulgham@apple.com>
+
+        Wait to get frame until after layout has been run
+        https://bugs.webkit.org/show_bug.cgi?id=197999
+        <rdar://problem/50800345>
+
+        Reviewed by Alex Christensen.
+
+        The current frame can change when layout runs, so don't bother retrieving
+        the frame until the final layout pass is complete.
+
+        Test: fast/dom/window-inner-width-crash.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::innerHeight const): Move frame access past the
+        layout operation.
+        (WebCore::DOMWindow::innerWidth const): Ditto.
+        (WebCore::DOMWindow::scrollX const): Ditto.
+        (WebCore::DOMWindow::scrollY const): Ditto.
+
 2019-05-19  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebCore/page/DOMWindow.cpp

@@ -1230 +1230 @@
 int DOMWindow::innerHeight() const
 {
-    auto* frame = this->frame();
-    if (!frame)
-        return 0;
-
+    if (!frame())
+        return 0;
+    
     // Force enough layout in the parent document to ensure that the FrameView has been resized.
     if (auto* frameElement = this->frameElement())
         frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, HeightDimensionsCheck);
 
+    auto* frame = this->frame();
+    if (!frame)
+        return 0;
+    
     FrameView* view = frame->view();
     if (!view)
@@ -1247 +1250 @@
 int DOMWindow::innerWidth() const
 {
-    auto* frame = this->frame();
-    if (!frame)
+    if (!frame())
         return 0;
 
@@ -1255 +1257 @@
         frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, WidthDimensionsCheck);
 
+    auto* frame = this->frame();
+    if (!frame)
+        return 0;
+
     FrameView* view = frame->view();
     if (!view)
@@ -1304 +1310 @@
     frame->document()->updateLayoutIgnorePendingStylesheets();
 
-    return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().x());
+    // Layout may have affected the current frame:
+    auto* frameAfterLayout = this->frame();
+    if (!frameAfterLayout)
+        return 0;
+    
+    FrameView* viewAfterLayout = frameAfterLayout->view();
+    if (!viewAfterLayout)
+        return 0;
+
+    return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().x());
 }
 
@@ -1323 +1338 @@
     frame->document()->updateLayoutIgnorePendingStylesheets();
 
-    return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().y());
+    // Layout may have affected the current frame:
+    auto* frameAfterLayout = this->frame();
+    if (!frameAfterLayout)
+        return 0;
+    
+    FrameView* viewAfterLayout = frameAfterLayout->view();
+    if (!viewAfterLayout)
+        return 0;
+    
+    return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().y());
 }