Changeset 286049 in webkit

Timestamp:

Nov 18, 2021, 11:30:40 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Nullptr crash in SimplifiedBackwardsTextIterator::range() via previousSentencePosition
​https://bugs.webkit.org/show_bug.cgi?id=229282

Patch by Frédéric Wang <​fwang@igalia.com> on 2021-11-18
Reviewed by Darin Adler.

Source/WebCore:

Constructors of TextIterator and SimplifiedBackwardsTextIterator update layout, which may
make HTMLObjectElement switch to fallback content and invalidate their renderer. As a
consequence their advance() method may incorrectly treat them as replaced elements. This
patch updates the layout at the beginning of FrameSelection::modify and disable post
resolution callbacks in order to prevent this kind of unaverted tree changes while browsing
the tree for selection update.

Test: editing/text-iterator/backward-textiterator-object-crash.html

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::modify): Update layout and disable post resolution callback, so that
all iterators used during the execution of the function handle <object>s consistently.

LayoutTests:

Add regression test.

• editing/text-iterator/backward-textiterator-object-crash-expected.txt: Added.
• editing/text-iterator/backward-textiterator-object-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/text-iterator/backward-textiterator-object-crash-expected.txt (added)
• LayoutTests/editing/text-iterator/backward-textiterator-object-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/FrameSelection.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-18  Frédéric Wang  <fwang@igalia.com>
+
+        Nullptr crash in SimplifiedBackwardsTextIterator::range() via previousSentencePosition
+        https://bugs.webkit.org/show_bug.cgi?id=229282
+
+        Reviewed by Darin Adler.
+
+        Add regression test.
+
+        * editing/text-iterator/backward-textiterator-object-crash-expected.txt: Added.
+        * editing/text-iterator/backward-textiterator-object-crash.html: Added.
+
 2021-11-18  Ben Nham  <nham@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-18  Frédéric Wang  <fwang@igalia.com>
+
+        Nullptr crash in SimplifiedBackwardsTextIterator::range() via previousSentencePosition
+        https://bugs.webkit.org/show_bug.cgi?id=229282
+
+        Reviewed by Darin Adler.
+
+        Constructors of TextIterator and SimplifiedBackwardsTextIterator update layout, which may
+        make HTMLObjectElement switch to fallback content and invalidate their renderer. As a
+        consequence their advance() method may incorrectly treat them as replaced elements. This
+        patch updates the layout at the beginning of FrameSelection::modify and disable post
+        resolution callbacks in order to prevent this kind of unaverted tree changes while browsing
+        the tree for selection update.
+
+        Test: editing/text-iterator/backward-textiterator-object-crash.html
+
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::modify): Update layout and disable post resolution callback, so that
+        all iterators used during the execution of the function handle <object>s consistently.
+
 2021-11-18  Antoine Quint  <graouts@webkit.org>
 

trunk/Source/WebCore/editing/FrameSelection.cpp

@@ -72 +72 @@
 #include "SpatialNavigation.h"
 #include "StyleProperties.h"
+#include "StyleTreeResolver.h"
 #include "TypingCommand.h"
 #include "VisibleUnits.h"
@@ -1344 +1345 @@
 
     willBeModified(alter, direction);
+
+    // Before modifying selection, update layout and disable post resolution callbacks.
+    // That way, unaverted tree changes are avoided while browsing the document.
+    auto selectionDocument = m_selection.document();
+    if (!selectionDocument)
+        return false;
+    selectionDocument->updateLayoutIgnorePendingStylesheets();
+    Style::PostResolutionCallbackDisabler disabler(*selectionDocument);
 
     bool reachedBoundary = false;