Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dad1793d6498a35aec1d08604ccd58544d3d83f3
https://github.com/WebKit/WebKit/commit/dad1793d6498a35aec1d08604ccd58544d3d83f3
Author: Kristian Monsen <[email protected]>
Date: 2026-04-20 (Mon, 20 Apr 2026)
Changed paths:
M Source/WebCore/editing/cocoa/AttributedString.mm
M Source/WebCore/editing/cocoa/NodeHTMLConverter.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm
Log Message:
-----------
[Cocoa] Calling -regularFileContents on a directory NSFileWrapper crashes the
web content process
https://bugs.webkit.org/show_bug.cgi?id=312594
rdar://174642216
Reviewed by Ryosuke Niwa.
When copying content containing an <img> element whose resolved URL points to a
directory (e.g. srcset="."), WebKit
can end up with a directory-backed NSFileWrapper. Calling -regularFileContents
on such a wrapper raises an
NSInvalidArgumentException. Because the exception unwinds through C++ stack
frames in HTMLConverter and
AttributedString, it is not caught and terminates the web content process.
Fix by guarding both -regularFileContents call sites with -isRegularFile before
extracting attachment data. The
preferredFilename and other metadata are still read regardless of file type.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm
* Source/WebCore/editing/cocoa/AttributedString.mm:
(WebCore::extractValue):
* Source/WebCore/editing/cocoa/NodeHTMLConverter.mm:
(HTMLConverter::_addAttachmentForElement):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm:
(TEST(CopyRTF, DoesNotCrashWithDirectoryFileWrapperFromImageSrcset)):
Canonical link: https://commits.webkit.org/311610@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
