Changeset 279304 in webkit

Timestamp:

Jun 25, 2021, 5:49:17 PM (5 years ago)

Author:

Wenson Hsieh

Message:

[iOS] Web process sometimes crashes under findDataDetectionResultElementInImageOverlay
​https://bugs.webkit.org/show_bug.cgi?id=227412
rdar://79588091

Reviewed by Devin Rousso.

Speculatively fix the crash by ensuring that the hit-tested text node inside an image overlay is inside the
shadow root of the element responding to click events, and that the element responding to click events contains
an image overlay.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::elementPositionInformation):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/ios/WebPageIOS.mm (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-06-25  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        [iOS] Web process sometimes crashes under findDataDetectionResultElementInImageOverlay
+        https://bugs.webkit.org/show_bug.cgi?id=227412
+        rdar://79588091
+
+        Reviewed by Devin Rousso.
+
+        Speculatively fix the crash by ensuring that the hit-tested text node inside an image overlay is inside the
+        shadow root of the element responding to click events, and that the element responding to click events contains
+        an image overlay.
+
+        * WebProcess/WebPage/ios/WebPageIOS.mm:
+        (WebKit::elementPositionInformation):
+
 2021-06-25  Per Arne  <pvollan@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm

@@ -2896 +2896 @@
 
 #if ENABLE(DATA_DETECTION)
-    if (info.isImageOverlayText && is<HTMLElement>(element))
-        dataDetectorImageOverlayPositionInformation(downcast<HTMLElement>(element), request, info);
+    if (info.isImageOverlayText && innerNonSharedNode->shadowHost() == &element && is<HTMLElement>(element)) {
+        if (auto htmlElement = makeRef(downcast<HTMLElement>(element)); htmlElement->hasImageOverlay())
+            dataDetectorImageOverlayPositionInformation(htmlElement.get(), request, info);
+    }
 #endif