Changeset 267287 in webkit

Timestamp:

Sep 18, 2020, 3:50:34 PM (6 years ago)

Author:

Chris Dumez

Message:

Crash under WebCore::shouldResetFocusNavigationStartingNode()
​https://bugs.webkit.org/show_bug.cgi?id=216714
<rdar://problem/68132047>

Reviewed by Darin Adler.

Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
it stays alive until the time we pass it to setFocusNavigationStartingNode().

• page/FrameView.cpp:

(WebCore::FrameView::scrollToFragmentInternal):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/FrameView.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-09-18  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebCore::shouldResetFocusNavigationStartingNode()
+        https://bugs.webkit.org/show_bug.cgi?id=216714
+        <rdar://problem/68132047>
+
+        Reviewed by Darin Adler.
+
+        Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
+        it stays alive until the time we pass it to setFocusNavigationStartingNode().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragmentInternal):
+
 2020-09-18  Aditya Keerthi  <akeerthi@apple.com>
 

trunk/Source/WebCore/page/FrameView.cpp

@@ -2214 +2214 @@
     RELEASE_ASSERT(document.haveStylesheetsLoaded());
 
-    Element* anchorElement = document.findAnchor(fragmentIdentifier);
-
-    LOG(Scrolling, " anchorElement is %p", anchorElement);
+    auto anchorElement = makeRefPtr(document.findAnchor(fragmentIdentifier));
+
+    LOG(Scrolling, " anchorElement is %p", anchorElement.get());
 
     // Setting to null will clear the current target.
-    document.setCSSTarget(anchorElement);
+    document.setCSSTarget(anchorElement.get());
 
     if (is<SVGDocument>(document)) {
@@ -2236 +2236 @@
     }
 
-    ContainerNode* scrollPositionAnchor = anchorElement;
+    RefPtr<ContainerNode> scrollPositionAnchor = anchorElement;
     if (!scrollPositionAnchor)
         scrollPositionAnchor = frame().document();
-    maintainScrollPositionAtAnchor(scrollPositionAnchor);
+    maintainScrollPositionAtAnchor(scrollPositionAnchor.get());
     
     // If the anchor accepts keyboard focus, move focus there to aid users relying on keyboard navigation.
     if (anchorElement) {
         if (anchorElement->isFocusable())
-            document.setFocusedElement(anchorElement);
+            document.setFocusedElement(anchorElement.get());
         else {
             document.setFocusedElement(nullptr);
-            document.setFocusNavigationStartingNode(anchorElement);
+            document.setFocusNavigationStartingNode(anchorElement.get());
         }
     }