Changeset 148894 in webkit

Timestamp:

Apr 22, 2013 10:56:22 AM (11 years ago)

Author:

commit-queue@webkit.org

Message:

Crash on OS X when shift clicking outside of input
​https://bugs.webkit.org/show_bug.cgi?id=104058

Patch by Yi Shen <​max.hong.shen@gmail.com> on 2013-04-22
Reviewed by Chang Shu.

Source/WebCore:

Shift clicking outside of a focused div while removing the focused div from
the dom tree at the same time may hit a null visible position, which should
not be used to calculate the text distance with the new selection's start and
end position. Otherwise, the browser may crash.

Test: editing/selection/crash-on-shift-click.html

• page/EventHandler.cpp:

(WebCore::EventHandler::handleMousePressEventSingleClick):

LayoutTests:

Add test for shift click crash issue.

• editing/selection/crash-on-shift-click-expected.txt: Added.
• editing/selection/crash-on-shift-click.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/selection/crash-on-shift-click-expected.txt (added)
• LayoutTests/editing/selection/crash-on-shift-click.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/EventHandler.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-04-22  Yi Shen  <max.hong.shen@gmail.com>
+
+        Crash on OS X when shift clicking outside of input
+        https://bugs.webkit.org/show_bug.cgi?id=104058
+
+        Reviewed by Chang Shu.
+
+        Add test for shift click crash issue.
+
+        * editing/selection/crash-on-shift-click-expected.txt: Added.
+        * editing/selection/crash-on-shift-click.html: Added.
+
 2013-04-22  Jessie Berlin  <jberlin@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-22  Yi Shen  <max.hong.shen@gmail.com>
+
+        Crash on OS X when shift clicking outside of input
+        https://bugs.webkit.org/show_bug.cgi?id=104058
+
+        Reviewed by Chang Shu.
+
+        Shift clicking outside of a focused div while removing the focused div from
+        the dom tree at the same time may hit a null visible position, which should
+        not be used to calculate the text distance with the new selection's start and
+        end position. Otherwise, the browser may crash.
+
+        Test: editing/selection/crash-on-shift-click.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
 2013-04-22  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/page/EventHandler.cpp

@@ -606 +606 @@
         }
 
-        if (!m_frame->editor()->behavior().shouldConsiderSelectionAsDirectional()) {
+        if (!m_frame->editor()->behavior().shouldConsiderSelectionAsDirectional() && pos.isNotNull()) {
             // See <rdar://problem/3668157> REGRESSION (Mail): shift-click deselects when selection
             // was created right-to-left