Changeset 276688 in webkit

Timestamp:

Apr 27, 2021, 7:54:40 PM (5 years ago)

Author:

Wenson Hsieh

Message:

[iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
​https://bugs.webkit.org/show_bug.cgi?id=225072
rdar://77159489

Reviewed by Darin Adler.

Source/WebCore:

Add a helper method to check whether or not the given Position is in a tree scope. See WebKit/ChangeLog for
more details.

Test: editing/selection/ios/clear-selection-while-moving-selection-handles.html

• dom/Position.h:

(WebCore::Position::isInTreeScope const):

Source/WebKit:

Make rangeForPointInRootViewCoordinates robust in the case where the original selection may have become
orphaned or null, by checking that the targetNode and existing selectionStart or selectionEnd are in a
tree scope before accessing treeScope().

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::rangeForPointInRootViewCoordinates):

LayoutTests:

Add a layout test that programmatically clears the selection in the middle of changing it by moving selection
handles.

• editing/selection/ios/clear-selection-while-moving-selection-handles-expected.txt: Added.
• editing/selection/ios/clear-selection-while-moving-selection-handles.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/selection/ios/clear-selection-while-moving-selection-handles-expected.txt (added)
• LayoutTests/editing/selection/ios/clear-selection-while-moving-selection-handles.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Position.h (modified) (1 diff)
• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-27  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        [iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
+        https://bugs.webkit.org/show_bug.cgi?id=225072
+        rdar://77159489
+
+        Reviewed by Darin Adler.
+
+        Add a layout test that programmatically clears the selection in the middle of changing it by moving selection
+        handles.
+
+        * editing/selection/ios/clear-selection-while-moving-selection-handles-expected.txt: Added.
+        * editing/selection/ios/clear-selection-while-moving-selection-handles.html: Added.
+
 2021-04-27  Diego Pino Garcia  <dpino@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-27  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        [iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
+        https://bugs.webkit.org/show_bug.cgi?id=225072
+        rdar://77159489
+
+        Reviewed by Darin Adler.
+
+        Add a helper method to check whether or not the given `Position` is in a tree scope. See WebKit/ChangeLog for
+        more details.
+
+        Test: editing/selection/ios/clear-selection-while-moving-selection-handles.html
+
+        * dom/Position.h:
+        (WebCore::Position::isInTreeScope const):
+
 2021-04-27  Cameron McCormack  <heycam@apple.com>
 

trunk/Source/WebCore/dom/Position.h

@@ -125 +125 @@
     }
 
+    bool isInTreeScope() const { return m_anchorNode && m_anchorNode->isInTreeScope(); }
+
     // These should only be used for PositionIsOffsetInAnchor positions, unless
     // the position is a legacy editing position.

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-04-27  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        [iOS] Web content process occasionally crashes under VisibleSelection::adjustPositionForEnd
+        https://bugs.webkit.org/show_bug.cgi?id=225072
+        rdar://77159489
+
+        Reviewed by Darin Adler.
+
+        Make `rangeForPointInRootViewCoordinates` robust in the case where the original selection may have become
+        orphaned or null, by checking that the `targetNode` and existing `selectionStart` or `selectionEnd` are in a
+        tree scope before accessing `treeScope()`.
+
+        * WebProcess/WebPage/ios/WebPageIOS.mm:
+        (WebKit::rangeForPointInRootViewCoordinates):
+
 2021-04-27  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm

@@ -1525 +1525 @@
         if (result <= selectionStart)
             result = selectionStart.next();
-        else if (targetNode && selectionStart.deepEquivalent().treeScope() != &targetNode->treeScope())
+        else if (targetNode && targetNode->isInTreeScope() && selectionStart.deepEquivalent().isInTreeScope() && selectionStart.deepEquivalent().treeScope() != &targetNode->treeScope())
             result = VisibleSelection::adjustPositionForEnd(result.deepEquivalent(), selectionStart.deepEquivalent().containerNode());
 
@@ -1532 +1532 @@
         if (selectionEnd <= result)
             result = selectionEnd.previous();
-        else if (targetNode && selectionEnd.deepEquivalent().treeScope() != &targetNode->treeScope())
+        else if (targetNode && targetNode->isInTreeScope() && selectionEnd.deepEquivalent().isInTreeScope() && selectionEnd.deepEquivalent().treeScope() != &targetNode->treeScope())
             result = VisibleSelection::adjustPositionForStart(result.deepEquivalent(), selectionEnd.deepEquivalent().containerNode());