Changeset 273298 in webkit

Timestamp:

Feb 22, 2021 7:50:54 PM (3 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION (r272928): ASSERT NOT REACHED in WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance
​https://bugs.webkit.org/show_bug.cgi?id=222219
<rdar://problem/74548257>

Reviewed by Wenson Hsieh.

The assertion failure was caused by confirmCompositionAndNotifyClient called in commitProvisionalLoad
committing the composition even though the composition node had been removed from the document.

Fixed the bug by canceling the composition if the composition node had been removed or the selection
had been moved away from it in confirmCompositionAndNotifyClient.

Test: editing/input/select-all-clear-input-method.html

• editing/Editor.cpp:

(WebCore::Editor::confirmOrCancelCompositionAndNotifyClient): Renamed from confirmCompositionAndNotifyClient.

• editing/Editor.h:
• loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/Editor.cpp (modified) (2 diffs)
• editing/Editor.h (modified) (1 diff)
• loader/FrameLoader.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION (r272928): ASSERT NOT REACHED in WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance
+        https://bugs.webkit.org/show_bug.cgi?id=222219
+        <rdar://problem/74548257>
+
+        Reviewed by Wenson Hsieh.
+
+        The assertion failure was caused by confirmCompositionAndNotifyClient called in commitProvisionalLoad
+        committing the composition even though the composition node had been removed from the document.
+
+        Fixed the bug by canceling the composition if the composition node had been removed or the selection
+        had been moved away from it in confirmCompositionAndNotifyClient.
+
+        Test: editing/input/select-all-clear-input-method.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::confirmOrCancelCompositionAndNotifyClient): Renamed from confirmCompositionAndNotifyClient.
+        * editing/Editor.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
 2021-02-22  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/editing/Editor.cpp

@@ -1944 +1944 @@
 }
 
-void Editor::confirmCompositionAndNotifyClient()
+void Editor::confirmOrCancelCompositionAndNotifyClient()
 {
     if (!hasComposition())
@@ -1951 +1951 @@
     auto frame = makeRefPtr(m_document.frame());
     if (!frame)
+        return;
+
+    if (cancelCompositionIfSelectionIsInvalid())
         return;
 

trunk/Source/WebCore/editing/Editor.h

@@ -380 +380 @@
     WEBCORE_EXPORT void confirmComposition();
     WEBCORE_EXPORT void confirmComposition(const String&); // if no existing composition, replaces selection
-    void confirmCompositionAndNotifyClient();
+    void confirmOrCancelCompositionAndNotifyClient();
     WEBCORE_EXPORT void cancelComposition();
     bool cancelCompositionIfSelectionIsInvalid();

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -1988 +1988 @@
         // attempt to confirm any active composition once again in this scenario after we
         // finish restoring from the cached page.
-        document->editor().confirmCompositionAndNotifyClient();
+        document->editor().confirmOrCancelCompositionAndNotifyClient();
     }
 
@@ -2069 +2069 @@
 
     if (auto document = makeRefPtr(m_frame.document()))
-        document->editor().confirmCompositionAndNotifyClient();
+        document->editor().confirmOrCancelCompositionAndNotifyClient();
 
     LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame.tree().uniqueName().string().utf8().data(),