Changeset 249514 in webkit

Timestamp:

Sep 4, 2019, 7:36:28 PM (7 years ago)

Author:

Wenson Hsieh

Message:

MobileSafari may crash when invoking the C++ lambda in -[WKContentView _shareForWebView:]
​https://bugs.webkit.org/show_bug.cgi?id=201479
<rdar://problem/51511834>

Reviewed by Tim Horton.

Source/WebKit:

Fix the crash by making -_shareForWebView: robust in the case where there are no selection rects
known in the UI process when -[WKContentView _share:] is invoked.

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _shareForWebView:]):

Tools:

Add a test to verify that the UI process doesn't crash when invoking _share: while there's no selection.

• TestWebKitAPI/Tests/WebKitCocoa/WKContentViewEditingActions.mm:
• TestWebKitAPI/ios/UIKitSPI.h:

Location:

trunk

Files:

• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WebKitCocoa/WKContentViewEditingActions.mm (modified) (2 diffs)
• Tools/TestWebKitAPI/ios/UIKitSPI.h (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-09-04  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        MobileSafari may crash when invoking the C++ lambda in -[WKContentView _shareForWebView:]
+        https://bugs.webkit.org/show_bug.cgi?id=201479
+        <rdar://problem/51511834>
+
+        Reviewed by Tim Horton.
+
+        Fix the crash by making -_shareForWebView: robust in the case where there are no selection rects
+        known in the UI process when -[WKContentView _share:] is invoked.
+
+        * UIProcess/ios/WKContentViewInteraction.mm:
+        (-[WKContentView _shareForWebView:]):
+
 2019-09-04  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm

@@ -2801 +2801 @@
         if (error != WebKit::CallbackBase::Error::None)
             return;
-        if (!string)
+
+        if (!view->_textSelectionAssistant || !string || view->_page->editorState().isMissingPostLayoutData)
             return;
 
-        CGRect presentationRect = view->_page->editorState().postLayoutData().selectionRects[0].rect();
-
-        if (view->_textSelectionAssistant)
-            [view->_textSelectionAssistant showShareSheetFor:string fromRect:presentationRect];
+        auto& selectionRects = view->_page->editorState().postLayoutData().selectionRects;
+        if (selectionRects.isEmpty())
+            return;
+
+        [view->_textSelectionAssistant showShareSheetFor:string fromRect:selectionRects.first().rect()];
     });
 }

trunk/Tools/ChangeLog

@@ +1 @@
+2019-09-04  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        MobileSafari may crash when invoking the C++ lambda in -[WKContentView _shareForWebView:]
+        https://bugs.webkit.org/show_bug.cgi?id=201479
+        <rdar://problem/51511834>
+
+        Reviewed by Tim Horton.
+
+        Add a test to verify that the UI process doesn't crash when invoking `_share:` while there's no selection.
+
+        * TestWebKitAPI/Tests/WebKitCocoa/WKContentViewEditingActions.mm:
+        * TestWebKitAPI/ios/UIKitSPI.h:
+
 2019-09-04  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKContentViewEditingActions.mm

@@ -32 +32 @@
 #import "TestNavigationDelegate.h"
 #import "TestWKWebView.h"
+#import "UIKitSPI.h"
 #import <WebKit/WebKit.h>
 #import <wtf/RetainPtr.h>
@@ -63 +64 @@
 }
 
+TEST(WebKit, InvokeShareWithoutSelection)
+{
+    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:CGRectMake(0, 0, 320, 568)]);
+    [webView synchronouslyLoadTestPageNamed:@"simple"];
+    [[webView textInputContentView] _share:nil];
+    [webView waitForNextPresentationUpdate];
+}
+
 #endif

trunk/Tools/TestWebKitAPI/ios/UIKitSPI.h

@@ -256 +256 @@
 @end
 
+@interface UIResponder (Internal)
+- (void)_share:(id)sender;
+@end
+
 #endif // PLATFORM(IOS_FAMILY)