⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245823 in webkit


Ignore:
Timestamp:
May 28, 2019, 2:02:38 PM (7 years ago)
Author:
Brent Fulgham
Message:

Protect frames during style and layout changes
​https://bugs.webkit.org/show_bug.cgi?id=198047
<rdar://problem/50954082>

Reviewed by Zalan Bujtas.

Be more careful about the scope and lifetime of objects that participate in layout or
style updates. If a method decides a layout or style update is needed, it needs to
confirm that the elements it was operating on are still valid and needed in the
current operation.

Source/WebCore:

  • accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::getOrCreate):

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::accessibilityHitTest const):

  • css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::valueForPropertyinStyle):

  • css/CSSComputedStyleDeclaration.h:
  • css/SVGCSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::svgPropertyValue):

  • dom/Document.cpp:

(WebCore::Document::setFocusedElement):

  • editing/TypingCommand.cpp:

(WebCore::TypingCommand::insertTextRunWithoutNewlines):
(WebCore::TypingCommand::insertLineBreak):
(WebCore::TypingCommand::insertParagraphSeparator):
(WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):

  • editing/ios/EditorIOS.mm:

(WebCore::Editor::setDictationPhrasesAsChildOfElement):

  • html/HTMLLabelElement.cpp:

(WebCore::HTMLLabelElement::focus):

  • html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::appendFormData):

  • html/ImageDocument.cpp:

(WebCore::ImageDocument::imageClicked):

  • html/ValidationMessage.cpp:

(WebCore::ValidationMessage::buildBubbleTree):

  • page/FrameView.cpp:

(WebCore::FrameView::autoSizeIfEnabled):
(WebCore::FrameView::trackedRepaintRectsAsText const):

  • page/PrintContext.cpp:

(WebCore::PrintContext::pageProperty):
(WebCore::PrintContext::numberOfPages):
(WebCore::PrintContext::spoolAllPagesWithBoundaries):

Source/WebKitLegacy/mac:

  • DOM/DOM.mm:

(-[DOMRange renderedImageForcingBlackText:renderedImageForcingBlackText:]):

  • WebView/WebHTMLView.mm:

(-[WebHTMLView _selectionDraggingImage]):
(-[WebHTMLView selectionImageForcingBlackText:selectionImageForcingBlackText:]):

Location:
trunk/Source
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r245818 r245823  
     12019-05-28  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Protect frames during style and layout changes
     4        https://bugs.webkit.org/show_bug.cgi?id=198047
     5        <rdar://problem/50954082>
     6
     7        Reviewed by Zalan Bujtas.
     8
     9        Be more careful about the scope and lifetime of objects that participate in layout or
     10        style updates. If a method decides a layout or style update is needed, it needs to
     11        confirm that the elements it was operating on are still valid and needed in the
     12        current operation.
     13
     14        * accessibility/AXObjectCache.cpp:
     15        (WebCore::AXObjectCache::getOrCreate):
     16        * accessibility/AccessibilityRenderObject.cpp:
     17        (WebCore::AccessibilityRenderObject::accessibilityHitTest const):
     18        * css/CSSComputedStyleDeclaration.cpp:
     19        (WebCore::ComputedStyleExtractor::valueForPropertyinStyle):
     20        * css/CSSComputedStyleDeclaration.h:
     21        * css/SVGCSSComputedStyleDeclaration.cpp:
     22        (WebCore::ComputedStyleExtractor::svgPropertyValue):
     23        * dom/Document.cpp:
     24        (WebCore::Document::setFocusedElement):
     25        * editing/TypingCommand.cpp:
     26        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
     27        (WebCore::TypingCommand::insertLineBreak):
     28        (WebCore::TypingCommand::insertParagraphSeparator):
     29        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
     30        * editing/ios/EditorIOS.mm:
     31        (WebCore::Editor::setDictationPhrasesAsChildOfElement):
     32        * html/HTMLLabelElement.cpp:
     33        (WebCore::HTMLLabelElement::focus):
     34        * html/HTMLTextAreaElement.cpp:
     35        (WebCore::HTMLTextAreaElement::appendFormData):
     36        * html/ImageDocument.cpp:
     37        (WebCore::ImageDocument::imageClicked):
     38        * html/ValidationMessage.cpp:
     39        (WebCore::ValidationMessage::buildBubbleTree):
     40        * page/FrameView.cpp:
     41        (WebCore::FrameView::autoSizeIfEnabled):
     42        (WebCore::FrameView::trackedRepaintRectsAsText const):
     43        * page/PrintContext.cpp:
     44        (WebCore::PrintContext::pageProperty):
     45        (WebCore::PrintContext::numberOfPages):
     46        (WebCore::PrintContext::spoolAllPagesWithBoundaries):
     47
    1482019-05-28  Antti Koivisto  <antti@apple.com>
    249

  • trunk/Source/WebCore/accessibility/AXObjectCache.cpp

    r244200 r245823  
    11/*
    2  * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    594594    if (!inCanvasSubtree && !isHidden && !insideMeterElement)
    595595        return nullptr;
     596
     597    auto protectedNode = makeRef(*node);
    596598
    597599    // Fallback content is only focusable as long as the canvas is displayed and visible.

  • trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp

    r245716 r245823  
    11/*
    2 * Copyright (C) 2008 Apple Inc. All rights reserved.
     2* Copyright (C) 2008-2019 Apple Inc. All rights reserved.
    33*
    44* Redistribution and use in source and binary forms, with or without
    … …  
    24182418    m_renderer->document().updateLayout();
    24192419
     2420    if (!m_renderer || !m_renderer->hasLayer())
     2421        return nullptr;
     2422
    24202423    RenderLayer* layer = downcast<RenderBox>(*m_renderer).layer();
    24212424     

  • trunk/Source/WebCore/css/CSSComputedStyleDeclaration.cpp

    r245768 r245823  
    11/*
    22 * Copyright (C) 2004 Zack Rusin <zack@kde.org>
    3  * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
     3 * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
    44 * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
    55 * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
    … …  
    42244224        case CSSPropertyTextAnchor:
    42254225        case CSSPropertyVectorEffect:
    4226             return svgPropertyValue(propertyID, DoNotUpdateLayout);
     4226            return svgPropertyValue(propertyID);
    42274227        case CSSPropertyCustom:
    42284228            ASSERT_NOT_REACHED();

  • trunk/Source/WebCore/css/CSSComputedStyleDeclaration.h

    r243931 r245823  
    8989    RenderElement* styledRenderer() const;
    9090
    91     RefPtr<CSSValue> svgPropertyValue(CSSPropertyID, EUpdateLayout);
     91    RefPtr<CSSValue> svgPropertyValue(CSSPropertyID);
    9292    Ref<CSSValue> adjustSVGPaintForCurrentColor(SVGPaintType, const String& url, const Color&, const Color& currentColor) const;
    9393    static Ref<CSSValue> valueForShadow(const ShadowData*, CSSPropertyID, const RenderStyle&, AdjustPixelValuesForComputedStyle = AdjustPixelValues);

  • trunk/Source/WebCore/css/SVGCSSComputedStyleDeclaration.cpp

    r243163 r245823  
    22    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
    33    Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
     4    Copyright (C) 2019 Apple Inc. All rights reserved.
    45
    56    This library is free software; you can redistribute it and/or
    … …  
    8283}
    8384
    84 RefPtr<CSSValue> ComputedStyleExtractor::svgPropertyValue(CSSPropertyID propertyID, EUpdateLayout updateLayout)
     85RefPtr<CSSValue> ComputedStyleExtractor::svgPropertyValue(CSSPropertyID propertyID)
    8586{
    8687    if (!m_element)
    8788        return nullptr;
    88 
    89     // Make sure our layout is up to date before we allow a query on these attributes.
    90     if (updateLayout)
    91         m_element->document().updateLayout();
    9289
    9390    auto* style = m_element->computedStyle();

  • trunk/Source/WebCore/dom/Document.cpp

    r245796 r245823  
    42594259            if (focusWidget)
    42604260                focusWidget->setFocus(true);
    4261             else
    4262                 view()->setFocus(true);
     4261            else if (auto* frameView = view())
     4262                frameView->setFocus(true);
    42634263        }
    42644264    }

  • trunk/Source/WebCore/editing/TypingCommand.cpp

    r239535 r245823  
    11/*
    2  * Copyright (C) 2005-2008, 2016 Apple Inc.  All rights reserved.
     2 * Copyright (C) 2005-2019 Apple Inc.  All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    552552    applyCommandToComposite(WTFMove(command), endingSelection());
    553553
     554    Frame& frame = this->frame();
     555    Ref<Frame> protector(frame);
    554556    typingAddedToOpenCommand(InsertText);
    555557}
    … …  
    564566
    565567    applyCommandToComposite(InsertLineBreakCommand::create(document()));
     568
     569    Frame& frame = this->frame();
     570    Ref<Frame> protector(frame);
    566571    typingAddedToOpenCommand(InsertLineBreak);
    567572}
    … …  
    584589
    585590    applyCommandToComposite(InsertParagraphSeparatorCommand::create(document(), false, false, EditAction::TypingInsertParagraph));
     591
     592    Frame& frame = this->frame();
     593    Ref<Frame> protector(frame);
    586594    typingAddedToOpenCommand(InsertParagraphSeparator);
    587595}
    … …  
    608616       
    609617    applyCommandToComposite(BreakBlockquoteCommand::create(document()));
     618
     619    Frame& frame = this->frame();
     620    Ref<Frame> protector(frame);
    610621    typingAddedToOpenCommand(InsertParagraphSeparatorInQuotedContent);
    611622}

  • trunk/Source/WebCore/editing/ios/EditorIOS.mm

    r240237 r245823  
    11/*
    2  * Copyright (C) 2006, 2007, 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    280280    element.appendChild(createFragmentFromText(*context, dictationPhrasesBuilder.toString()));
    281281
     282    auto weakElement = makeWeakPtr(element);
     283
    282284    // We need a layout in order to add markers below.
    283285    document().updateLayout();
     286
     287    if (!weakElement)
     288        return;
    284289
    285290    if (!element.firstChild()->isTextNode()) {

  • trunk/Source/WebCore/html/HTMLLabelElement.cpp

    r229694 r245823  
    33 *           (C) 1999 Antti Koivisto (koivisto@kde.org)
    44 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    5  * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
     5 * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
    66 *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
    77 *
    … …  
    150150void HTMLLabelElement::focus(bool restorePreviousSelection, FocusDirection direction)
    151151{
     152    Ref<HTMLLabelElement> protectedThis(*this);
    152153    if (document().haveStylesheetsLoaded()) {
    153154        document().updateLayout();

  • trunk/Source/WebCore/html/HTMLTextAreaElement.cpp

    r242379 r245823  
    33 *           (C) 1999 Antti Koivisto (koivisto@kde.org)
    44 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    5  * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
     5 * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
    66 *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
    77 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
    … …  
    224224        return false;
    225225
     226    Ref<HTMLTextAreaElement> protectedThis(*this);
    226227    document().updateLayout();
    227228

  • trunk/Source/WebCore/html/ImageDocument.cpp

    r245508 r245823  
    11/*
    2  * Copyright (C) 2006, 2007, 2008, 2010, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    400400        updateLayout();
    401401
     402        if (!view())
     403            return;
     404
    402405        float scale = this->scale();
    403406

  • trunk/Source/WebCore/html/ValidationMessage.cpp

    r234278 r245823  
    11/*
    22 * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
     3 * Copyright (C) 2019 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    188189    m_bubble->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
    189190    shadowRoot.appendChild(*m_bubble);
     191
     192    auto weakElement = makeWeakPtr(*m_element);
     193
    190194    document.updateLayout();
     195
     196    if (!weakElement || !m_element->renderer())
     197        return;
     198
    191199    adjustBubblePosition(m_element->renderer()->absoluteBoundingBoxRect(), m_bubble.get());
    192200

  • trunk/Source/WebCore/page/FrameView.cpp

    r245787 r245823  
    44 *                     1999 Antti Koivisto <koivisto@kde.org>
    55 *                     2000 Dirk Mueller <mueller@kde.org>
    6  * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
     6 * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
    77 *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
    88 *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
    … …  
    34693469    documentRenderer.mutableStyle().setMaxWidth(Length(m_autoSizeConstraint.width(), Fixed));
    34703470    resize(m_autoSizeConstraint.width(), m_autoSizeConstraint.height());
     3471
     3472    Ref<FrameView> protectedThis(*this);
    34713473    document->updateStyleIfNeeded();
    34723474    document->updateLayoutIgnorePendingStylesheets();
    … …  
    48674869String FrameView::trackedRepaintRectsAsText() const
    48684870{
    4869     if (frame().document())
    4870         frame().document()->updateLayout();
     4871    Frame& frame = this->frame();
     4872    Ref<Frame> protector(frame);
     4873
     4874    if (auto* document = frame.document())
     4875        document->updateLayout();
    48714876
    48724877    TextStream ts;

  • trunk/Source/WebCore/page/PrintContext.cpp

    r244208 r245823  
    11/*
    22 * Copyright (C) 2007 Alp Toker <alp@atoker.com>
    3  * Copyright (C) 2007, 2016 Apple Inc.
     3 * Copyright (C) 2007-2019 Apple Inc.
    44 *
    55 * This library is free software; you can redistribute it and/or
    … …  
    346346    ASSERT(frame->document());
    347347
     348    Ref<Frame> protectedFrame(*frame);
     349
    348350    auto& document = *frame->document();
    349351    PrintContext printContext(frame);
    … …  
    401403int PrintContext::numberOfPages(Frame& frame, const FloatSize& pageSizeInPixels)
    402404{
     405    Ref<Frame> protectedFrame(frame);
     406
    403407    PrintContext printContext(&frame);
    404408    if (!printContext.beginAndComputePageRectsWithPageSize(frame, pageSizeInPixels))
    … …  
    410414void PrintContext::spoolAllPagesWithBoundaries(Frame& frame, GraphicsContext& graphicsContext, const FloatSize& pageSizeInPixels)
    411415{
     416    Ref<Frame> protectedFrame(frame);
     417
    412418    PrintContext printContext(&frame);
    413419    if (!printContext.beginAndComputePageRectsWithPageSize(frame, pageSizeInPixels))

  • trunk/Source/WebKitLegacy/mac/ChangeLog

    r245796 r245823  
     12019-05-28  Brent Fulgham  <bfulgham@apple.com>
     2        Protect frames during style and layout changes
     3        https://bugs.webkit.org/show_bug.cgi?id=198047
     4        <rdar://problem/50954082>
     5
     6        Reviewed by Zalan Bujtas.
     7
     8        Be more careful about the scope and lifetime of objects that participate in layout or
     9        style updates. If a method decides a layout or style update is needed, it needs to
     10        confirm that the elements it was operating on are still valid and needed in the
     11        current operation.
     12
     13        * DOM/DOM.mm:
     14        (-[DOMRange renderedImageForcingBlackText:renderedImageForcingBlackText:]):
     15        * WebView/WebHTMLView.mm:
     16        (-[WebHTMLView _selectionDraggingImage]):
     17        (-[WebHTMLView selectionImageForcingBlackText:selectionImageForcingBlackText:]):
     18
    1192019-05-27  Chris Dumez  <cdumez@apple.com>
    220

  • trunk/Source/WebKitLegacy/mac/DOM/DOM.mm

    r239535 r245823  
    11/*
    2  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
     2 * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
    33 * Copyright (C) 2006 James G. Speth (speth@end.com)
    44 * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
    … …  
    619619        return nil;
    620620
     621    Ref<Frame> protectedFrame(*frame);
     622
    621623    // iOS uses CGImageRef for drag images, which doesn't support separate logical/physical sizes.
    622624#if PLATFORM(MAC)

  • trunk/Source/WebKitLegacy/mac/WebView/WebHTMLView.mm

    r245076 r245823  
    11/*
    2  * Copyright (C) 2005-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2005-2019 Apple Inc. All rights reserved.
    33 *           (C) 2006, 2007 Graham Dennis (graham.dennis@gmail.com)
    44 *
    … …  
    22012201        return nil;
    22022202
     2203    Ref<Frame> protectedCoreFrame(*coreFrame);
     2204
    22032205    TextIndicatorData textIndicator;
    22042206    auto dragImage = createDragImageForSelection(*coreFrame, textIndicator);
    … …  
    69616963        return nil;
    69626964
     6965    Ref<Frame> protectedCoreFrame(*coreFrame);
     6966
    69636967#if PLATFORM(IOS_FAMILY)
    69646968    return selectionImage(coreFrame, forceBlackText);
Note: See TracChangeset for help on using the changeset viewer.