Changeset 185827 in webkit

Timestamp:

Jun 22, 2015, 7:32:48 AM (10 years ago)

Author:

Antti Koivisto

Message:

Crash replacing TabDocument in MobileSafari at WebKit: -[WKWebView(WKPrivate) _beginAnimatedResizeWithUpdates:]
​https://bugs.webkit.org/show_bug.cgi?id=146201

Reviewed by Dan Bernstein.

• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _beginAnimatedResizeWithUpdates:]):

No repro but if for some reason [_contentView bounds] width is zero we'll compute +Inf targetScale
and then NaN contentOffset.x. Verified in lldb that this gives the exact crash signature seen.

Fix by checking that [_contentView bounds] is not empty like is done with other inputs.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/Cocoa/WKWebView.mm (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog ¶

@@ +1 @@
+2015-06-22  Antti Koivisto  <antti@apple.com>
+
+        Crash replacing TabDocument in MobileSafari at WebKit: -[WKWebView(WKPrivate) _beginAnimatedResizeWithUpdates:]
+        https://bugs.webkit.org/show_bug.cgi?id=146201
+
+        Reviewed by Dan Bernstein.
+
+        * UIProcess/API/Cocoa/WKWebView.mm:
+        (-[WKWebView _beginAnimatedResizeWithUpdates:]):
+
+        No repro but if for some reason [_contentView bounds] width is zero we'll compute +Inf targetScale
+        and then NaN contentOffset.x. Verified in lldb that this gives the exact crash signature seen.
+
+        Fix by checking that [_contentView bounds] is not empty like is done with other inputs.
+
 2015-06-22  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm ¶

@@ -2623 +2623 @@
     UIEdgeInsets newObscuredInsets = _obscuredInsets;
     CGRect futureUnobscuredRectInSelfCoordinates = UIEdgeInsetsInsetRect(newBounds, _obscuredInsets);
+    CGRect contentViewBounds = [_contentView bounds];
 
     ASSERT_WITH_MESSAGE(!(_overridesMinimumLayoutSize && newMinimumLayoutSize.isEmpty()), "Clients controlling the layout size should maintain a valid layout size to minimize layouts.");
-    if (CGRectIsEmpty(newBounds) || newMinimumLayoutSize.isEmpty() || CGRectIsEmpty(futureUnobscuredRectInSelfCoordinates)) {
+    if (CGRectIsEmpty(newBounds) || newMinimumLayoutSize.isEmpty() || CGRectIsEmpty(futureUnobscuredRectInSelfCoordinates) || CGRectIsEmpty(contentViewBounds)) {
         _dynamicViewportUpdateMode = DynamicViewportUpdateMode::NotResizing;
         [self _frameOrBoundsChanged];
@@ -2656 +2657 @@
     [_resizeAnimationView addSubview:[_contentView unscaledView]];
 
-    CGSize contentSizeInContentViewCoordinates = [_contentView bounds].size;
+    CGSize contentSizeInContentViewCoordinates = contentViewBounds.size;
     [_scrollView setMinimumZoomScale:std::min(newMinimumLayoutSize.width() / contentSizeInContentViewCoordinates.width, [_scrollView minimumZoomScale])];
     [_scrollView setMaximumZoomScale:std::max(newMinimumLayoutSize.width() / contentSizeInContentViewCoordinates.width, [_scrollView maximumZoomScale])];