Changeset 239546 in webkit

Timestamp:

Dec 23, 2018 3:51:30 PM (5 years ago)

Author:

Wenson Hsieh

Message:

Fix fast/ruby/ruby-base-merge-block-children-crash-2.html after r239543
​https://bugs.webkit.org/show_bug.cgi?id=193015
<rdar://problem/46583527>

Reviewed by Tim Horton.

Fix the crash by gracefully handling integer overflow when computing the area of a very large editable element.

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _elementDidFocus:userIsInteracting:blurPreviousNode:changingActivityState:userObject:]):
(-[WKContentView _updateChangedSelection:]):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/ios/WKContentViewInteraction.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-12-23  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Fix fast/ruby/ruby-base-merge-block-children-crash-2.html after r239543
+        https://bugs.webkit.org/show_bug.cgi?id=193015
+        <rdar://problem/46583527>
+
+        Reviewed by Tim Horton.
+
+        Fix the crash by gracefully handling integer overflow when computing the area of a very large editable element.
+
+        * UIProcess/ios/WKContentViewInteraction.mm:
+        (-[WKContentView _elementDidFocus:userIsInteracting:blurPreviousNode:changingActivityState:userObject:]):
+        (-[WKContentView _updateChangedSelection:]):
+
 2018-12-22  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm

@@ -4477 +4477 @@
         [self _stopSuppressingSelectionAssistantForReason:WebKit::FocusedElementIsTransparent];
 
-    if (information.elementRect.area() < minimumFocusedElementAreaForSuppressingSelectionAssistant)
+    auto elementArea = information.elementRect.area<RecordOverflow>();
+    if (!elementArea.hasOverflowed() && elementArea < minimumFocusedElementAreaForSuppressingSelectionAssistant)
         [self _beginSuppressingSelectionAssistantForReason:WebKit::FocusedElementIsTooSmall];
     else
@@ -5014 +5015 @@
             [self _stopSuppressingSelectionAssistantForReason:WebKit::FocusedElementIsTransparent];
 
-        if (postLayoutData.focusedElementRect.area() < minimumFocusedElementAreaForSuppressingSelectionAssistant)
+        auto elementArea = postLayoutData.focusedElementRect.area<RecordOverflow>();
+        if (!elementArea.hasOverflowed() && elementArea < minimumFocusedElementAreaForSuppressingSelectionAssistant)
             [self _beginSuppressingSelectionAssistantForReason:WebKit::FocusedElementIsTooSmall];
         else