Title: [242861] branches/safari-607-branch
- Revision
- 242861
- Author
- [email protected]
- Date
- 2019-03-13 01:24:54 -0700 (Wed, 13 Mar 2019)
Log Message
Cherry-pick r242749. rdar://problem/48839358
[macOS] Dispatching reentrant "contextmenu" events may cause crashes
https://bugs.webkit.org/show_bug.cgi?id=195571
<rdar://problem/48086046>
Reviewed by Andy Estes.
Source/WebCore:
Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
a result of handling a context menu event.
Test: fast/events/contextmenu-reentrancy-crash.html
* page/ContextMenuController.cpp:
(WebCore::ContextMenuController::handleContextMenuEvent):
* page/ContextMenuController.h:
LayoutTests:
Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
* fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
* fast/events/contextmenu-reentrancy-crash.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (242860 => 242861)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-13 08:24:51 UTC (rev 242860)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-13 08:24:54 UTC (rev 242861)
@@ -1,5 +1,50 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242749. rdar://problem/48839358
+
+ [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+ https://bugs.webkit.org/show_bug.cgi?id=195571
+ <rdar://problem/48086046>
+
+ Reviewed by Andy Estes.
+
+ Source/WebCore:
+
+ Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+ As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+ synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+ a result of handling a context menu event.
+
+ Test: fast/events/contextmenu-reentrancy-crash.html
+
+ * page/ContextMenuController.cpp:
+ (WebCore::ContextMenuController::handleContextMenuEvent):
+ * page/ContextMenuController.h:
+
+ LayoutTests:
+
+ Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+
+ * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+ * fast/events/contextmenu-reentrancy-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-11 Wenson Hsieh <[email protected]>
+
+ [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+ https://bugs.webkit.org/show_bug.cgi?id=195571
+ <rdar://problem/48086046>
+
+ Reviewed by Andy Estes.
+
+ Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+
+ * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+ * fast/events/contextmenu-reentrancy-crash.html: Added.
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242587. rdar://problem/48839354
Crash when attempting to change input type while dismissing datalist suggestions
Added: branches/safari-607-branch/LayoutTests/fast/events/contextmenu-reentrancy-crash-expected.txt (0 => 242861)
--- branches/safari-607-branch/LayoutTests/fast/events/contextmenu-reentrancy-crash-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/events/contextmenu-reentrancy-crash-expected.txt 2019-03-13 08:24:54 UTC (rev 242861)
@@ -0,0 +1,3 @@
+This test verifies that we don't crash when attempting to handle "contextmenu" events in a reentrant manner. This test passes if the green text "PASS" is present after page load.
+
+PASS
Added: branches/safari-607-branch/LayoutTests/fast/events/contextmenu-reentrancy-crash.html (0 => 242861)
--- branches/safari-607-branch/LayoutTests/fast/events/contextmenu-reentrancy-crash.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/events/contextmenu-reentrancy-crash.html 2019-03-13 08:24:54 UTC (rev 242861)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This test verifies that we don't crash when attempting to handle "contextmenu" events in a reentrant manner. This test passes if the green text "PASS" is present after page load.</p>
+</body>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function dispatchContextMenuEvent() {
+ document.body.dispatchEvent(new MouseEvent("contextmenu"));
+}
+
+document.designMode = "on";
+document.addEventListener("beforepaste", dispatchContextMenuEvent);
+dispatchContextMenuEvent();
+document.writeln("<pre style='color: green'>PASS</pre>");
+</script>
+</html>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (242860 => 242861)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-13 08:24:51 UTC (rev 242860)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-13 08:24:54 UTC (rev 242861)
@@ -1,5 +1,56 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242749. rdar://problem/48839358
+
+ [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+ https://bugs.webkit.org/show_bug.cgi?id=195571
+ <rdar://problem/48086046>
+
+ Reviewed by Andy Estes.
+
+ Source/WebCore:
+
+ Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+ As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+ synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+ a result of handling a context menu event.
+
+ Test: fast/events/contextmenu-reentrancy-crash.html
+
+ * page/ContextMenuController.cpp:
+ (WebCore::ContextMenuController::handleContextMenuEvent):
+ * page/ContextMenuController.h:
+
+ LayoutTests:
+
+ Add a test to verify that triggering reentrant "contextmenu" events from script does not cause a crash.
+
+ * fast/events/contextmenu-reentrancy-crash-expected.txt: Added.
+ * fast/events/contextmenu-reentrancy-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-11 Wenson Hsieh <[email protected]>
+
+ [macOS] Dispatching reentrant "contextmenu" events may cause crashes
+ https://bugs.webkit.org/show_bug.cgi?id=195571
+ <rdar://problem/48086046>
+
+ Reviewed by Andy Estes.
+
+ Make ContextMenuController::handleContextMenuEvent robust against reentrancy by guarding it with a boolean flag.
+ As demonstrated in the test case, it is currently possible to force WebKit into a bad state by dispatching a
+ synthetic "contextmenu" event from within the scope of one of the "before(copy|cut|paste)" events triggered as
+ a result of handling a context menu event.
+
+ Test: fast/events/contextmenu-reentrancy-crash.html
+
+ * page/ContextMenuController.cpp:
+ (WebCore::ContextMenuController::handleContextMenuEvent):
+ * page/ContextMenuController.h:
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242587. rdar://problem/48839354
Crash when attempting to change input type while dismissing datalist suggestions
Modified: branches/safari-607-branch/Source/WebCore/page/ContextMenuController.cpp (242860 => 242861)
--- branches/safari-607-branch/Source/WebCore/page/ContextMenuController.cpp 2019-03-13 08:24:51 UTC (rev 242860)
+++ branches/safari-607-branch/Source/WebCore/page/ContextMenuController.cpp 2019-03-13 08:24:54 UTC (rev 242861)
@@ -68,6 +68,7 @@
#include "UserTypingGestureIndicator.h"
#include "WindowFeatures.h"
#include "markup.h"
+#include <wtf/SetForScope.h>
#include <wtf/WallTime.h>
#include <wtf/unicode/CharacterNames.h>
@@ -97,6 +98,11 @@
void ContextMenuController::handleContextMenuEvent(Event& event)
{
+ if (m_isHandlingContextMenuEvent)
+ return;
+
+ SetForScope<bool> isHandlingContextMenuEventForScope(m_isHandlingContextMenuEvent, true);
+
m_contextMenu = maybeCreateContextMenu(event);
if (!m_contextMenu)
return;
Modified: branches/safari-607-branch/Source/WebCore/page/ContextMenuController.h (242860 => 242861)
--- branches/safari-607-branch/Source/WebCore/page/ContextMenuController.h 2019-03-13 08:24:51 UTC (rev 242860)
+++ branches/safari-607-branch/Source/WebCore/page/ContextMenuController.h 2019-03-13 08:24:54 UTC (rev 242861)
@@ -93,6 +93,7 @@
std::unique_ptr<ContextMenu> m_contextMenu;
RefPtr<ContextMenuProvider> m_menuProvider;
ContextMenuContext m_context;
+ bool m_isHandlingContextMenuEvent { false };
};
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
