Changeset 279529 in webkit

Timestamp:

Jul 2, 2021, 6:24:12 PM (5 years ago)

Author:

Kocsen Chung

Message:

Cherry-pick r278964. rdar://problem/79474157

Protect Element before calling dispatchMouseEvent() on it
​https://bugs.webkit.org/show_bug.cgi?id=226767
<rdar://problem/79009112>

Reviewed by Ryosuke Niwa.

• page/EventHandler.cpp: (WebCore::EventHandler::updateMouseEventTargetNode): (WebCore::EventHandler::dispatchMouseEvent):
• page/PointerLockController.cpp: (WebCore::PointerLockController::dispatchLockedMouseEvent):
• page/Quirks.cpp: (WebCore::Quirks::triggerOptionalStorageAccessQuirk const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@278964 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-611.3.10.1-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Element.cpp (modified) (1 diff)
• page/EventHandler.cpp (modified) (3 diffs)
• page/PointerLockController.cpp (modified) (1 diff)
• page/Quirks.cpp (modified) (1 diff)

branches/safari-611.3.10.1-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2021-07-02  Ruben Turcios  <rubent_22@apple.com>
+
+        Cherry-pick r278964. rdar://problem/79474157
+
+    Protect Element before calling dispatchMouseEvent() on it
+    https://bugs.webkit.org/show_bug.cgi?id=226767
+    <rdar://problem/79009112>
+    
+    Reviewed by Ryosuke Niwa.
+    
+    * page/EventHandler.cpp:
+    (WebCore::EventHandler::updateMouseEventTargetNode):
+    (WebCore::EventHandler::dispatchMouseEvent):
+    * page/PointerLockController.cpp:
+    (WebCore::PointerLockController::dispatchLockedMouseEvent):
+    * page/Quirks.cpp:
+    (WebCore::Quirks::triggerOptionalStorageAccessQuirk const):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@278964 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-06-16  Chris Dumez  <cdumez@apple.com>
+
+            Protect Element before calling dispatchMouseEvent() on it
+            https://bugs.webkit.org/show_bug.cgi?id=226767
+            <rdar://problem/79009112>
+
+            Reviewed by Ryosuke Niwa.
+
+            * page/EventHandler.cpp:
+            (WebCore::EventHandler::updateMouseEventTargetNode):
+            (WebCore::EventHandler::dispatchMouseEvent):
+            * page/PointerLockController.cpp:
+            (WebCore::PointerLockController::dispatchLockedMouseEvent):
+            * page/Quirks.cpp:
+            (WebCore::Quirks::triggerOptionalStorageAccessQuirk const):
+
 2021-06-21  Alan Coon  <alancoon@apple.com>
 

branches/safari-611.3.10.1-branch/Source/WebCore/dom/Element.cpp

@@ -386 +386 @@
         return true; // Shouldn't happen.
 
+    Ref protectedThis { *this };
     bool didNotSwallowEvent = true;
 

branches/safari-611.3.10.1-branch/Source/WebCore/page/EventHandler.cpp

@@ -2548 +2548 @@
             }
 
-            if (m_lastElementUnderMouse)
-                m_lastElementUnderMouse->dispatchMouseEvent(platformMouseEvent, eventNames().mouseoutEvent, 0, m_elementUnderMouse.get());
+            if (auto lastElementUnderMouse = m_lastElementUnderMouse)
+                lastElementUnderMouse->dispatchMouseEvent(platformMouseEvent, eventNames().mouseoutEvent, 0, m_elementUnderMouse.get());
 
             for (auto& chain : leftElementsChain) {
@@ -2556 +2556 @@
             }
 
-            if (m_elementUnderMouse)
-                m_elementUnderMouse->dispatchMouseEvent(platformMouseEvent, eventNames().mouseoverEvent, 0, m_lastElementUnderMouse.get());
+            if (auto elementUnderMouse = m_elementUnderMouse)
+                elementUnderMouse->dispatchMouseEvent(platformMouseEvent, eventNames().mouseoverEvent, 0, m_lastElementUnderMouse.get());
 
             for (auto& chain : WTF::makeReversedRange(enteredElementsChain)) {
@@ -2641 +2641 @@
     updateMouseEventTargetNode(eventType, targetNode, platformMouseEvent, fireMouseOverOut);
 
-    if (m_elementUnderMouse && !m_elementUnderMouse->dispatchMouseEvent(platformMouseEvent, eventType, clickCount))
-        return false;
+    if (auto elementUnderMouse = m_elementUnderMouse) {
+        if (!elementUnderMouse->dispatchMouseEvent(platformMouseEvent, eventType, clickCount))
+            return false;
+    }
 
     if (eventType != eventNames().mousedownEvent)

branches/safari-611.3.10.1-branch/Source/WebCore/page/PointerLockController.cpp

@@ -182 +182 @@
         return;
 
-    m_element->dispatchMouseEvent(event, eventType, event.clickCount());
+    Ref protectedElement { *m_element };
+    protectedElement->dispatchMouseEvent(event, eventType, event.clickCount());
 
     // Create click events
     if (eventType == eventNames().mouseupEvent)
-        m_element->dispatchMouseEvent(event, eventNames().clickEvent, event.clickCount());
+        protectedElement->dispatchMouseEvent(event, eventNames().clickEvent, event.clickCount());
 }
 

branches/safari-611.3.10.1-branch/Source/WebCore/page/Quirks.cpp

@@ -1193 +1193 @@
         if (isStorageAccessQuirkDomainAndElement(m_document->url(), element)) {
             return requestStorageAccessAndHandleClick([element = makeWeakPtr(element), platformEvent, eventType, detail, relatedTarget] (ShouldDispatchClick shouldDispatchClick) mutable {
-                if (!element)
+                RefPtr protectedElement { element.get() };
+                if (!protectedElement)
                     return;
 
                 if (shouldDispatchClick == ShouldDispatchClick::Yes)
-                    element->dispatchMouseEvent(platformEvent, eventType, detail, relatedTarget);
+                    protectedElement->dispatchMouseEvent(platformEvent, eventType, detail, relatedTarget);
             });
         }