Changeset 277425 in webkit

Timestamp:

May 12, 2021, 11:45:07 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

RELEASE_ASSERT(m_selection->isNone()) fails in Document::removedLastRef
​https://bugs.webkit.org/show_bug.cgi?id=225434

Patch by Frederic Wang <​fwang@igalia.com> on 2021-05-12
Reviewed by Ryosuke Niwa.

Document::removedLastRef asserts that the document's selection is not set. However, setting
that selection is possible in FrameSelection::setSelectionWithoutUpdatingAppearance when the
document has not been destroyed yet but is already detached from its frame. This patch
instead clears the selection in that case.

No new tests.

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance): Clears the selection when
newSelection is in a detached document. Given the other conditions, this is actually
checking equivalent to !m_document->frame().

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/FrameSelection.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-05-12  Frederic Wang  <fwang@igalia.com>
+
+        RELEASE_ASSERT(m_selection->isNone()) fails in Document::removedLastRef
+        https://bugs.webkit.org/show_bug.cgi?id=225434
+
+        Reviewed by Ryosuke Niwa.
+
+        Document::removedLastRef asserts that the document's selection is not set. However, setting
+        that selection is possible in FrameSelection::setSelectionWithoutUpdatingAppearance when the
+        document has not been destroyed yet but is already detached from its frame. This patch
+        instead clears the selection in that case.
+
+        No new tests.
+
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance): Clears the selection when
+        newSelection is in a detached document. Given the other conditions, this is actually
+        checking equivalent to !m_document->frame().
+
 2021-05-12  Peng Liu  <peng.liu6@apple.com>
 

trunk/Source/WebCore/editing/FrameSelection.cpp

@@ -364 +364 @@
         }
 
-        if (!m_document || !m_document->frame()) {
+        if (!m_document) {
             m_selection = newSelection;
             updateAssociatedLiveRange();
@@ -372 +372 @@
         bool selectionEndpointsBelongToMultipleDocuments = newSelection.base().document() && !newSelection.document();
         bool selectionIsInAnotherDocument = newSelection.document() && newSelection.document() != m_document.get();
-        if (selectionEndpointsBelongToMultipleDocuments || selectionIsInAnotherDocument) {
+        bool selectionIsInDetachedDocument = newSelection.document() && !newSelection.document()->frame();
+        if (selectionEndpointsBelongToMultipleDocuments || selectionIsInAnotherDocument || selectionIsInDetachedDocument) {
             clear();
             return false;