Changeset 267678 in webkit

Timestamp:

Sep 27, 2020, 1:00:28 PM (6 years ago)

Author:

Alan Coon

Message:

Cherry-pick r267287. rdar://problem/69594243

Crash under WebCore::shouldResetFocusNavigationStartingNode()
​https://bugs.webkit.org/show_bug.cgi?id=216714
<rdar://problem/68132047>

Reviewed by Darin Adler.

Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
it stays alive until the time we pass it to setFocusNavigationStartingNode().

• page/FrameView.cpp: (WebCore::FrameView::scrollToFragmentInternal):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@267287 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-610-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/FrameView.cpp (modified) (2 diffs)

branches/safari-610-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2020-09-27  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r267287. rdar://problem/69594243
+
+    Crash under WebCore::shouldResetFocusNavigationStartingNode()
+    https://bugs.webkit.org/show_bug.cgi?id=216714
+    <rdar://problem/68132047>
+    
+    Reviewed by Darin Adler.
+    
+    Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
+    it stays alive until the time we pass it to setFocusNavigationStartingNode().
+    
+    * page/FrameView.cpp:
+    (WebCore::FrameView::scrollToFragmentInternal):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267287 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-09-18  Chris Dumez  <cdumez@apple.com>
+
+            Crash under WebCore::shouldResetFocusNavigationStartingNode()
+            https://bugs.webkit.org/show_bug.cgi?id=216714
+            <rdar://problem/68132047>
+
+            Reviewed by Darin Adler.
+
+            Protect anchorElement in FrameView::scrollToFragmentInternal() to make sure
+            it stays alive until the time we pass it to setFocusNavigationStartingNode().
+
+            * page/FrameView.cpp:
+            (WebCore::FrameView::scrollToFragmentInternal):
+
 2020-09-27  Alan Coon  <alancoon@apple.com>
 

branches/safari-610-branch/Source/WebCore/page/FrameView.cpp

@@ -2208 +2208 @@
     RELEASE_ASSERT(document.haveStylesheetsLoaded());
 
-    Element* anchorElement = document.findAnchor(fragmentIdentifier);
-
-    LOG(Scrolling, " anchorElement is %p", anchorElement);
+    auto anchorElement = makeRefPtr(document.findAnchor(fragmentIdentifier));
+
+    LOG(Scrolling, " anchorElement is %p", anchorElement.get());
 
     // Setting to null will clear the current target.
-    document.setCSSTarget(anchorElement);
+    document.setCSSTarget(anchorElement.get());
 
     if (is<SVGDocument>(document)) {
@@ -2230 +2230 @@
     }
 
-    ContainerNode* scrollPositionAnchor = anchorElement;
+    RefPtr<ContainerNode> scrollPositionAnchor = anchorElement;
     if (!scrollPositionAnchor)
         scrollPositionAnchor = frame().document();
-    maintainScrollPositionAtAnchor(scrollPositionAnchor);
+    maintainScrollPositionAtAnchor(scrollPositionAnchor.get());
     
     // If the anchor accepts keyboard focus, move focus there to aid users relying on keyboard navigation.
     if (anchorElement) {
         if (anchorElement->isFocusable())
-            document.setFocusedElement(anchorElement);
+            document.setFocusedElement(anchorElement.get());
         else {
             document.setFocusedElement(nullptr);
-            document.setFocusNavigationStartingNode(anchorElement);
+            document.setFocusNavigationStartingNode(anchorElement.get());
         }
     }