Changeset 269620 in webkit

Timestamp:

Nov 10, 2020 1:03:04 AM (3 years ago)

Author:

Carlos Garcia Campos

Message:

[GTK] Crash in WebKit::DropTarget::drop
​https://bugs.webkit.org/show_bug.cgi?id=217482

Reviewed by Michael Catanzaro.

If we don't have selection data when drop is called, just return early to let leave continue. Also change
accept() to receive the drop context and position to be set after leaving any previous operation.

• UIProcess/API/gtk/DropTarget.h:
• UIProcess/API/gtk/DropTargetGtk3.cpp:

(WebKit::DropTarget::DropTarget):
(WebKit::DropTarget::accept):
(WebKit::DropTarget::drop):

• UIProcess/API/gtk/DropTargetGtk4.cpp:

(WebKit::DropTarget::DropTarget):
(WebKit::DropTarget::accept):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/gtk/DropTarget.h (modified) (2 diffs)
• UIProcess/API/gtk/DropTargetGtk3.cpp (modified) (4 diffs)
• UIProcess/API/gtk/DropTargetGtk4.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-11-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Crash in WebKit::DropTarget::drop
+        https://bugs.webkit.org/show_bug.cgi?id=217482
+
+        Reviewed by Michael Catanzaro.
+
+        If we don't have selection data when drop is called, just return early to let leave continue. Also change
+        accept() to receive the drop context and position to be set after leaving any previous operation.
+
+        * UIProcess/API/gtk/DropTarget.h:
+        * UIProcess/API/gtk/DropTargetGtk3.cpp:
+        (WebKit::DropTarget::DropTarget):
+        (WebKit::DropTarget::accept):
+        (WebKit::DropTarget::drop):
+        * UIProcess/API/gtk/DropTargetGtk4.cpp:
+        (WebKit::DropTarget::DropTarget):
+        (WebKit::DropTarget::accept):
+
 2020-11-10  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit/UIProcess/API/gtk/DropTarget.h

@@ -40 +40 @@
 #if USE(GTK4)
 typedef struct _GdkDrop GdkDrop;
+using PlatformDropContext = GdkDrop;
 #else
 typedef struct _GdkDragContext GdkDragContext;
 typedef struct _GtkSelectionData GtkSelectionData;
+using PlatformDropContext = GdkDragContext;
 #endif
 
@@ -58 +60 @@
 
 private:
-    void accept(unsigned = 0);
+    void accept(PlatformDropContext*, Optional<WebCore::IntPoint> = WTF::nullopt, unsigned = 0);
     void enter(WebCore::IntPoint&&, unsigned = 0);
     void update(WebCore::IntPoint&&, unsigned = 0);

trunk/Source/WebKit/UIProcess/API/gtk/DropTargetGtk3.cpp

@@ -60 +60 @@
         auto& drop = *static_cast<DropTarget*>(userData);
         if (drop.m_drop != context) {
-            drop.m_drop = context;
-            drop.m_position = IntPoint(x, y);
-            drop.accept(time);
+            drop.accept(context, IntPoint(x, y), time);
         } else if (drop.m_drop == context)
             drop.update({ x, y }, time);
@@ -98 +96 @@
 }
 
-void DropTarget::accept(unsigned time)
+void DropTarget::accept(GdkDragContext* drop, Optional<WebCore::IntPoint> position, unsigned time)
 {
     if (m_leaveTimer.isActive()) {
@@ -105 +103 @@
     }
 
+    m_drop = drop;
+    m_position = position;
     m_dataRequestCount = 0;
     m_selectionData = WTF::nullopt;
@@ -260 +260 @@
 void DropTarget::drop(IntPoint&& position, unsigned time)
 {
+    // If we don't have data at this point, allow the leave timer to fire, ending the drop operation.
+    if (!m_selectionData)
+        return;
+
     if (m_leaveTimer.isActive())
         m_leaveTimer.stop();

trunk/Source/WebKit/UIProcess/API/gtk/DropTargetGtk4.cpp

@@ -55 +55 @@
     g_signal_connect(target, "accept", G_CALLBACK(+[](GtkDropTargetAsync*, GdkDrop* gdkDrop, gpointer userData) -> gboolean {
         auto& drop = *static_cast<DropTarget*>(userData);
-        drop.m_drop = gdkDrop;
-        drop.accept();
+        drop.accept(gdkDrop);
         return TRUE;
     }), this);
@@ -103 +102 @@
 }
 
-void DropTarget::accept(unsigned)
-{
-    m_position = WTF::nullopt;
+void DropTarget::accept(GdkDrop* drop, Optional<WebCore::IntPoint> position, unsigned)
+{
+    m_drop = drop;
+    m_position = position;
     m_selectionData = SelectionData();
     m_dataRequestCount = 0;