Changeset 275591 in webkit

Timestamp:

Apr 7, 2021 12:42:44 AM (3 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION(r274812): Release assert in Document::updateLayout() after calling focus({preventScroll: true}) on a textarea
​https://bugs.webkit.org/show_bug.cgi?id=224262

Reviewed by Antti Koivisto.

Source/WebCore:

The regression was caused by Element::focus not updating the selection when preventScroll is set to true.
Fixed it by always updating the selection whenever Element::focus is called.

Test: fast/forms/textarea/textarea-focus-prevent-scroll-crash.html

• dom/Element.cpp:

(WebCore::Element::focus):
(WebCore::Element::findTargetAndUpdateFocusAppearance): Renamed from revealFocusedElement.

• dom/Element.h:
• page/EventHandler.cpp:

(WebCore::EventHandler::dispatchMouseEvent):

LayoutTests:

Added a regression test.

• fast/forms/textarea/textarea-focus-prevent-scroll-crash-expected.txt: Added.
• fast/forms/textarea/textarea-focus-prevent-scroll-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/textarea/textarea-focus-prevent-scroll-crash-expected.txt (added)
• LayoutTests/fast/forms/textarea/textarea-focus-prevent-scroll-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Element.cpp (modified) (1 diff)
• Source/WebCore/dom/Element.h (modified) (1 diff)
• Source/WebCore/page/EventHandler.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r274812): Release assert in Document::updateLayout() after calling focus({preventScroll: true}) on a textarea
+        https://bugs.webkit.org/show_bug.cgi?id=224262
+
+        Reviewed by Antti Koivisto.
+
+        Added a regression test.
+
+        * fast/forms/textarea/textarea-focus-prevent-scroll-crash-expected.txt: Added.
+        * fast/forms/textarea/textarea-focus-prevent-scroll-crash.html: Added.
+
 2021-04-06  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r274812): Release assert in Document::updateLayout() after calling focus({preventScroll: true}) on a textarea
+        https://bugs.webkit.org/show_bug.cgi?id=224262
+
+        Reviewed by Antti Koivisto.
+
+        The regression was caused by Element::focus not updating the selection when preventScroll is set to true.
+        Fixed it by always updating the selection whenever Element::focus is called.
+
+        Test: fast/forms/textarea/textarea-focus-prevent-scroll-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        (WebCore::Element::findTargetAndUpdateFocusAppearance): Renamed from revealFocusedElement.
+        * dom/Element.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+
 2021-04-07  Stephan Szabo  <stephan.szabo@sony.com>
 

trunk/Source/WebCore/dom/Element.cpp

@@ -3089 +3089 @@
     }
 
-    if (!options.preventScroll)
-        newTarget->revealFocusedElement(options.selectionRestorationMode);
-}
-
-void Element::revealFocusedElement(SelectionRestorationMode selectionMode)
-{
-    SelectionRevealMode revealMode = SelectionRevealMode::Reveal;
-
+    newTarget->findTargetAndUpdateFocusAppearance(options.selectionRestorationMode, options.preventScroll ? SelectionRevealMode::DoNotReveal : SelectionRevealMode::Reveal);
+}
+
+void Element::findTargetAndUpdateFocusAppearance(SelectionRestorationMode selectionMode, SelectionRevealMode revealMode)
+{
 #if PLATFORM(IOS_FAMILY)
     // Focusing a form element triggers animation in UIKit to scroll to the right position.
     // Calling updateFocusAppearance() would generate an unnecessary call to ScrollView::setScrollPosition(),
     // which would jump us around during this animation. See <rdar://problem/6699741>.
-    if (is<HTMLFormControlElement>(*this))
+    if (revealMode == SelectionRevealMode::Reveal && is<HTMLFormControlElement>(*this))
         revealMode = SelectionRevealMode::RevealUpToMainFrame;
 #endif

trunk/Source/WebCore/dom/Element.h

@@ -406 +406 @@
     static AXTextStateChangeIntent defaultFocusTextStateChangeIntent() { return AXTextStateChangeIntent(AXTextStateChangeTypeSelectionMove, AXTextSelection { AXTextSelectionDirectionDiscontiguous, AXTextSelectionGranularityUnknown, true }); }
     virtual void focus(const FocusOptions& = { });
-    void revealFocusedElement(SelectionRestorationMode);
+    void findTargetAndUpdateFocusAppearance(SelectionRestorationMode, SelectionRevealMode = SelectionRevealMode::Reveal);
     virtual RefPtr<Element> focusAppearanceUpdateTarget();
     virtual void updateFocusAppearance(SelectionRestorationMode, SelectionRevealMode = SelectionRevealMode::Reveal);

trunk/Source/WebCore/page/EventHandler.cpp

@@ -2724 +2724 @@
 
     if (element && m_mouseDownDelegatedFocus)
-        element->revealFocusedElement(SelectionRestorationMode::SelectAll);
+        element->findTargetAndUpdateFocusAppearance(SelectionRestorationMode::SelectAll);
 
     return true;