Changeset 247180 in webkit


Ignore:
Timestamp:
Jul 5, 2019 2:56:58 PM (5 years ago)
Author:
rniwa@webkit.org
Message:

[iOS] Crash in WebKit::WebPage::positionInformation via Range::startPosition
​https://bugs.webkit.org/show_bug.cgi?id=199503

Reviewed by Wenson Hsieh.

Source/WebCore:

  • editing/Editor.cpp:

(WebCore::Editor::compositionRange const): Added a FIXME.

Source/WebKit:

The crash was caused because focusedElementPositionInformation asssumes Editor::compositionRange is not null
whenever Editor::hasComposition returns true, which is not necessary the case when Editor::m_compositionNode
contains no text (data is of length 0).

Fixed the crash by adding an early return for when Editor::compositionRange returns nullptr.

  • WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::focusedElementPositionInformation):

Tools:

Added UIScriptController.ensurePositionInformationIsUpToDateAt using the existing WKWebView SPI:
_requestActivatedElementAtPosition

  • DumpRenderTree/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):

  • DumpRenderTree/mac/UIScriptControllerMac.mm:

(WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):

  • TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
  • TestRunnerShared/UIScriptContext/UIScriptController.cpp:

(WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):

  • TestRunnerShared/UIScriptContext/UIScriptController.h:
  • WebKitTestRunner/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):

  • WebKitTestRunner/ios/UIScriptControllerMac.mm:

(WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):

LayoutTests:

Added a regression test for the crash.

  • editing/input/delete-text-in-composition-expected.txt: Added.
  • editing/input/delete-text-in-composition.html: Added.
  • resources/ui-helper.js:

(window.UIHelper.ensurePositionInformationUpdateForElement): Added.

Location:
trunk
Files:
2 added
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r247174 r247180  
     12019-07-05  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        [iOS] Crash in WebKit::WebPage::positionInformation via Range::startPosition
     4        https://bugs.webkit.org/show_bug.cgi?id=199503
     5
     6        Reviewed by Wenson Hsieh.
     7
     8        Added a regression test for the crash.
     9
     10        * editing/input/delete-text-in-composition-expected.txt: Added.
     11        * editing/input/delete-text-in-composition.html: Added.
     12        * resources/ui-helper.js:
     13        (window.UIHelper.ensurePositionInformationUpdateForElement): Added.
     14
    1152019-07-02  Myles C. Maxfield  <mmaxfield@apple.com>
    216

  • trunk/LayoutTests/resources/ui-helper.js

    r247158 r247180  
    255255    }
    256256
     257    static ensurePositionInformationUpdateForElement(element)
     258    {
     259        const boundingRect = element.getBoundingClientRect();
     260        const x = boundingRect.x + 5;
     261        const y = boundingRect.y + 5;
     262
     263        if (!this.isWebKit2()) {
     264            testRunner.display();
     265            return Promise.resolve();
     266        }
     267
     268        return new Promise(resolve => {
     269            testRunner.runUIScript(`
     270                uiController.ensurePositionInformationIsUpToDateAt(${x}, ${y}, function () {
     271                    uiController.uiScriptComplete();
     272                });`, resolve);
     273        });
     274    }
     275
    257276    static delayFor(ms)
    258277    {

  • trunk/Source/WebCore/ChangeLog

    r247174 r247180  
     12019-07-05  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        [iOS] Crash in WebKit::WebPage::positionInformation via Range::startPosition
     4        https://bugs.webkit.org/show_bug.cgi?id=199503
     5
     6        Reviewed by Wenson Hsieh.
     7
     8        * editing/Editor.cpp:
     9        (WebCore::Editor::compositionRange const): Added a FIXME.
     10
    1112019-07-02  Myles C. Maxfield  <mmaxfield@apple.com>
    212

  • trunk/Source/WebCore/editing/Editor.cpp

    r246490 r247180  
    30783078    unsigned start = std::min(m_compositionStart, length);
    30793079    unsigned end = std::min(std::max(start, m_compositionEnd), length);
     3080    // FIXME: Why is this early return neeed?
    30803081    if (start >= end)
    30813082        return nullptr;

  • trunk/Source/WebKit/ChangeLog

    r247167 r247180  
     12019-07-05  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        [iOS] Crash in WebKit::WebPage::positionInformation via Range::startPosition
     4        https://bugs.webkit.org/show_bug.cgi?id=199503
     5
     6        Reviewed by Wenson Hsieh.
     7
     8        The crash was caused because focusedElementPositionInformation asssumes Editor::compositionRange is not null
     9        whenever Editor::hasComposition returns true, which is not necessary the case when Editor::m_compositionNode
     10        contains no text (data is of length 0).
     11
     12        Fixed the crash by adding an early return for when Editor::compositionRange returns nullptr.
     13
     14        * WebProcess/WebPage/ios/WebPageIOS.mm:
     15        (WebKit::focusedElementPositionInformation):
     16
    1172019-07-05  Zalan Bujtas  <zalan@apple.com>
    218

  • trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm

    r247167 r247180  
    25092509
    25102510    RefPtr<Range> compositionRange = frame.editor().compositionRange();
     2511    if (!compositionRange)
     2512        return;
     2513
    25112514    if (position < compositionRange->startPosition())
    25122515        position = compositionRange->startPosition();

  • trunk/Tools/ChangeLog

    r247164 r247180  
     12019-07-05  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        [iOS] Crash in WebKit::WebPage::positionInformation via Range::startPosition
     4        https://bugs.webkit.org/show_bug.cgi?id=199503
     5
     6        Reviewed by Wenson Hsieh.
     7
     8        Added UIScriptController.ensurePositionInformationIsUpToDateAt using the existing WKWebView SPI:
     9        _requestActivatedElementAtPosition
     10
     11        * DumpRenderTree/ios/UIScriptControllerIOS.mm:
     12        (WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):
     13        * DumpRenderTree/mac/UIScriptControllerMac.mm:
     14        (WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):
     15        * TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
     16        * TestRunnerShared/UIScriptContext/UIScriptController.cpp:
     17        (WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):
     18        * TestRunnerShared/UIScriptContext/UIScriptController.h:
     19        * WebKitTestRunner/ios/UIScriptControllerIOS.mm:
     20        (WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):
     21        * WebKitTestRunner/ios/UIScriptControllerMac.mm:
     22        (WTR::UIScriptController::ensurePositionInformationIsUpToDateAt):
     23
    1242019-07-05  Ryan Haddad  <ryanhaddad@apple.com>
    225

  • trunk/Tools/DumpRenderTree/ios/UIScriptControllerIOS.mm

    r247158 r247180  
    6464}
    6565
     66void UIScriptController::ensurePositionInformationIsUpToDateAt(long x, long y, JSValueRef callback)
     67{
     68    return doAsyncTask(callback);
     69}
     70
    6671void UIScriptController::doAfterVisibleContentRectUpdate(JSValueRef callback)
    6772{

  • trunk/Tools/DumpRenderTree/mac/UIScriptControllerMac.mm

    r242069 r247180  
    6262}
    6363
     64void UIScriptController::ensurePositionInformationIsUpToDateAt(long x, long y, JSValueRef callback)
     65{
     66    doAsyncTask(callback);
     67}
     68
    6469void UIScriptController::doAfterVisibleContentRectUpdate(JSValueRef callback)
    6570{

  • trunk/Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl

    r247158 r247180  
    4646    void doAfterPresentationUpdate(object callback); // Call the callback after sending a message to the WebProcess and receiving a subsequent update.
    4747    void doAfterNextStablePresentationUpdate(object callback);
    48 
     48    void ensurePositionInformationIsUpToDateAt(long x, long y, object callback);
    4949    void doAfterVisibleContentRectUpdate(object callback);
    5050

  • trunk/Tools/TestRunnerShared/UIScriptContext/UIScriptController.cpp

    r247158 r247180  
    102102}
    103103
     104void UIScriptController::ensurePositionInformationIsUpToDateAt(long x, long y, JSValueRef)
     105{
     106}
     107
    104108void UIScriptController::doAfterVisibleContentRectUpdate(JSValueRef)
    105109{

  • trunk/Tools/TestRunnerShared/UIScriptContext/UIScriptController.h

    r247158 r247180  
    6868    void doAfterPresentationUpdate(JSValueRef callback);
    6969    void doAfterNextStablePresentationUpdate(JSValueRef callback);
     70    void ensurePositionInformationIsUpToDateAt(long x, long y, JSValueRef callback);
    7071    void doAfterVisibleContentRectUpdate(JSValueRef callback);
    7172

  • trunk/Tools/WebKitTestRunner/ios/UIScriptControllerIOS.mm

    r247158 r247180  
    158158}
    159159
     160void UIScriptController::ensurePositionInformationIsUpToDateAt(long x, long y, JSValueRef callback)
     161{
     162    TestRunnerWKWebView *webView = TestController::singleton().mainWebView()->platformView();
     163
     164    unsigned callbackID = m_context->prepareForAsyncTask(callback, CallbackTypeNonPersistent);
     165    [webView _requestActivatedElementAtPosition:CGPointMake(x, y) completionBlock:^(_WKActivatedElementInfo *) {
     166        if (!m_context)
     167            return;
     168        m_context->asyncTaskComplete(callbackID);
     169    }];
     170}
     171
    160172void UIScriptController::doAfterVisibleContentRectUpdate(JSValueRef callback)
    161173{

  • trunk/Tools/WebKitTestRunner/mac/UIScriptControllerMac.mm

    r242339 r247180  
    6060}
    6161
     62void UIScriptController::ensurePositionInformationIsUpToDateAt(long, long, JSValueRef callback)
     63{
     64    doAsyncTask(callback);
     65}
     66
    6267void UIScriptController::doAfterVisibleContentRectUpdate(JSValueRef callback)
    6368{
Note: See TracChangeset for help on using the changeset viewer.