Changeset 167818 in webkit

Timestamp:

Apr 25, 2014 1:30:07 PM (10 years ago)

Author:

jhoneycutt@apple.com

Message:

Crash applying editing commands from iframe onload event

<​https://bugs.webkit.org/show_bug.cgi?id=132103>
<rdar://problem/15696351>

Source/WebCore:
This patch merges the Chromium bug workaround from
<​http://src.chromium.org/viewvc/blink?revision=162080&view=revision>,
which prevents reentrancy in CompositeEditCommand::apply().

Reviewed by Darin Adler.

Test: editing/apply-style-iframe-crash.html

• editing/CompositeEditCommand.cpp:

(WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
(WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
(WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
(WebCore::CompositeEditCommand::apply):
If this is a recursive call, return early.

LayoutTests:
Reviewed by Darin Adler.

• editing/apply-style-iframe-crash-expected.txt: Added.
• editing/apply-style-iframe-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/apply-style-iframe-crash-expected.txt (added)
• LayoutTests/editing/apply-style-iframe-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/CompositeEditCommand.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-04-23  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Crash applying editing commands from iframe onload event
+
+        <https://bugs.webkit.org/show_bug.cgi?id=132103>
+        <rdar://problem/15696351>
+
+        Reviewed by Darin Adler.
+
+        * editing/apply-style-iframe-crash-expected.txt: Added.
+        * editing/apply-style-iframe-crash.html: Added.
+
 2014-04-25  David Hyatt  <hyatt@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-04-23  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Crash applying editing commands from iframe onload event
+
+        <https://bugs.webkit.org/show_bug.cgi?id=132103>
+        <rdar://problem/15696351>
+
+        This patch merges the Chromium bug workaround from
+        <http://src.chromium.org/viewvc/blink?revision=162080&view=revision>,
+        which prevents reentrancy in CompositeEditCommand::apply().
+
+        Reviewed by Darin Adler.
+
+        Test: editing/apply-style-iframe-crash.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
+        (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
+        (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
+        (WebCore::CompositeEditCommand::apply):
+        If this is a recursive call, return early.
+
 2014-04-25  David Hyatt  <hyatt@apple.com>
 

trunk/Source/WebCore/editing/CompositeEditCommand.cpp

@@ -81 +81 @@
 using namespace HTMLNames;
 
+namespace ApplyEditCommand {
+    
+class ReentrancyGuard {
+public:
+    static bool isRecursiveCall() { return s_nestingCounter; }
+
+    class Scope {
+    public:
+        Scope() { ++s_nestingCounter; }
+        ~Scope() { --s_nestingCounter; }
+    };
+    friend class Scope;
+
+private:
+    static unsigned s_nestingCounter;
+};
+unsigned ApplyEditCommand::ReentrancyGuard::s_nestingCounter;
+    
+} // namespace ApplyEditCommand
+
 PassRefPtr<EditCommandComposition> EditCommandComposition::create(Document& document,
     const VisibleSelection& startingSelection, const VisibleSelection& endingSelection, EditAction editAction)
@@ -195 +215 @@
 void CompositeEditCommand::apply()
 {
+    // It's possible to enter this recursively, but legitimate cases of that are rare, and it can cause crashes. As a
+    // temporary fix, guard against recursive calls.
+    // FIXME: <rdar://16701803> Remove this workaround when <rdar://15797536> is fixed.
+    if (ApplyEditCommand::ReentrancyGuard::isRecursiveCall())
+        return;
+
     if (!endingSelection().isContentRichlyEditable()) {
         switch (editingAction()) {
@@ -221 +247 @@
 
     {
-        EventQueueScope scope;
+        EventQueueScope eventQueueScope;
+        ApplyEditCommand::ReentrancyGuard::Scope reentrancyGuardScope;
 #if ENABLE(DELETION_UI)
         DeleteButtonControllerDisableScope deleteButtonControllerDisableScope(&frame());