Changeset 245924 in webkit

Timestamp:

May 30, 2019, 5:30:10 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r245509. rdar://problem/51264845

Wait to get frame until after layout has been run
​https://bugs.webkit.org/show_bug.cgi?id=197999
<rdar://problem/50800345>

Reviewed by Alex Christensen.

Source/WebCore:

The current frame can change when layout runs, so don't bother retrieving
the frame until the final layout pass is complete.

Test: fast/dom/window-inner-width-crash.html

• page/DOMWindow.cpp: (WebCore::DOMWindow::innerHeight const): Move frame access past the layout operation. (WebCore::DOMWindow::innerWidth const): Ditto. (WebCore::DOMWindow::scrollX const): Ditto. (WebCore::DOMWindow::scrollY const): Ditto.

LayoutTests:

• fast/dom/window-inner-width-crash-expected.txt: Added.
• fast/dom/window-inner-width-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245509 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/window-inner-width-crash-expected.txt (added)
• LayoutTests/fast/dom/window-inner-width-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/DOMWindow.cpp (modified) (5 diffs)

branches/safari-607-branch/LayoutTests/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245509. rdar://problem/51264845
+
+    Wait to get frame until after layout has been run
+    https://bugs.webkit.org/show_bug.cgi?id=197999
+    <rdar://problem/50800345>
+    
+    Reviewed by Alex Christensen.
+    
+    Source/WebCore:
+    
+    The current frame can change when layout runs, so don't bother retrieving
+    the frame until the final layout pass is complete.
+    
+    Test: fast/dom/window-inner-width-crash.html
+    
+    * page/DOMWindow.cpp:
+    (WebCore::DOMWindow::innerHeight const): Move frame access past the
+    layout operation.
+    (WebCore::DOMWindow::innerWidth const): Ditto.
+    (WebCore::DOMWindow::scrollX const): Ditto.
+    (WebCore::DOMWindow::scrollY const): Ditto.
+    
+    LayoutTests:
+    
+    * fast/dom/window-inner-width-crash-expected.txt: Added.
+    * fast/dom/window-inner-width-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-19  Brent Fulgham  <bfulgham@apple.com>
+
+            Wait to get frame until after layout has been run
+            https://bugs.webkit.org/show_bug.cgi?id=197999
+            <rdar://problem/50800345>
+
+            Reviewed by Alex Christensen.
+
+            * fast/dom/window-inner-width-crash-expected.txt: Added.
+            * fast/dom/window-inner-width-crash.html: Added.
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245509. rdar://problem/51264845
+
+    Wait to get frame until after layout has been run
+    https://bugs.webkit.org/show_bug.cgi?id=197999
+    <rdar://problem/50800345>
+    
+    Reviewed by Alex Christensen.
+    
+    Source/WebCore:
+    
+    The current frame can change when layout runs, so don't bother retrieving
+    the frame until the final layout pass is complete.
+    
+    Test: fast/dom/window-inner-width-crash.html
+    
+    * page/DOMWindow.cpp:
+    (WebCore::DOMWindow::innerHeight const): Move frame access past the
+    layout operation.
+    (WebCore::DOMWindow::innerWidth const): Ditto.
+    (WebCore::DOMWindow::scrollX const): Ditto.
+    (WebCore::DOMWindow::scrollY const): Ditto.
+    
+    LayoutTests:
+    
+    * fast/dom/window-inner-width-crash-expected.txt: Added.
+    * fast/dom/window-inner-width-crash.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-19  Brent Fulgham  <bfulgham@apple.com>
+
+            Wait to get frame until after layout has been run
+            https://bugs.webkit.org/show_bug.cgi?id=197999
+            <rdar://problem/50800345>
+
+            Reviewed by Alex Christensen.
+
+            The current frame can change when layout runs, so don't bother retrieving
+            the frame until the final layout pass is complete.
+
+            Test: fast/dom/window-inner-width-crash.html
+
+            * page/DOMWindow.cpp:
+            (WebCore::DOMWindow::innerHeight const): Move frame access past the
+            layout operation.
+            (WebCore::DOMWindow::innerWidth const): Ditto.
+            (WebCore::DOMWindow::scrollX const): Ditto.
+            (WebCore::DOMWindow::scrollY const): Ditto.
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/WebCore/page/DOMWindow.cpp

@@ -1237 +1237 @@
 int DOMWindow::innerHeight() const
 {
-    auto* frame = this->frame();
-    if (!frame)
-        return 0;
-
+    if (!frame())
+        return 0;
+    
     // Force enough layout in the parent document to ensure that the FrameView has been resized.
     if (auto* frameElement = this->frameElement())
         frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, HeightDimensionsCheck);
 
+    auto* frame = this->frame();
+    if (!frame)
+        return 0;
+    
     FrameView* view = frame->view();
     if (!view)
@@ -1254 +1257 @@
 int DOMWindow::innerWidth() const
 {
-    auto* frame = this->frame();
-    if (!frame)
+    if (!frame())
         return 0;
 
@@ -1262 +1264 @@
         frameElement->document().updateLayoutIfDimensionsOutOfDate(*frameElement, WidthDimensionsCheck);
 
+    auto* frame = this->frame();
+    if (!frame)
+        return 0;
+
     FrameView* view = frame->view();
     if (!view)
@@ -1311 +1317 @@
     frame->document()->updateLayoutIgnorePendingStylesheets();
 
-    return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().x());
+    // Layout may have affected the current frame:
+    auto* frameAfterLayout = this->frame();
+    if (!frameAfterLayout)
+        return 0;
+    
+    FrameView* viewAfterLayout = frameAfterLayout->view();
+    if (!viewAfterLayout)
+        return 0;
+
+    return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().x());
 }
 
@@ -1330 +1345 @@
     frame->document()->updateLayoutIgnorePendingStylesheets();
 
-    return view->mapFromLayoutToCSSUnits(view->contentsScrollPosition().y());
+    // Layout may have affected the current frame:
+    auto* frameAfterLayout = this->frame();
+    if (!frameAfterLayout)
+        return 0;
+    
+    FrameView* viewAfterLayout = frameAfterLayout->view();
+    if (!viewAfterLayout)
+        return 0;
+    
+    return viewAfterLayout->mapFromLayoutToCSSUnits(viewAfterLayout->contentsScrollPosition().y());
 }