Source/WebKit2/ChangeLog

 12016-12-13 Ryosuke Niwa <rniwa@webkit.org>
 2
 3 Deleting a character converted from pinyin after an image causes a Safari crash
 4 https://bugs.webkit.org/show_bug.cgi?id=165839
 5
 6 Reviewed by Darin Adler.
 7
 8 The crash was caused by the payload of the IPC not being decoded correctly when the encoded attributed string
 9 contains a NSTextAttachment but send<> would still gladly send it to the UIProcess.
 10
 11 Fixed it by omitting the image as done in r176412 since encoding NSFileWrapper, etc... would require
 12 quite a bit of work, and IME doesn't really need to see the image in its attributed string.
 13
 14 * WebProcess/WebPage/mac/WebPageMac.mm:
 15 (WebKit::WebPage::attributedSubstringForCharacterRangeAsync): Fixed the bug.
 16
1172016-12-16 Andy Estes <aestes@apple.com>
218
319 Add a setting to suppress keyboard input during provisional navigation
209954

Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm

@@void WebPage::attributedSubstringForChar
362362 return;
363363 }
364364
365  result.string = editingAttributedStringFromRange(*range);
 365 result.string = editingAttributedStringFromRange(*range, IncludeImagesInAttributedString::No);
366366 NSAttributedString* attributedString = result.string.get();
367367
368368 // WebCore::editingAttributedStringFromRange() insists on inserting a trailing
209954

Tools/ChangeLog

 12016-12-16 Ryosuke Niwa <rniwa@webkit.org>
 2
 3 Deleting a character converted from pinyin after an image causes a Safari crash
 4 https://bugs.webkit.org/show_bug.cgi?id=165839
 5 <rdar://problem/27951933>
 6
 7 Reviewed by Wenson Hsieh.
 8
 9 Add a WebKit API test to call attributedSubstringForProposedRange on a WKWebView
 10 while the proposed range contains an image. This should not cause a WebProcess to crash
 11 or send an invalid message to the UIProcess.
 12
 13 * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
 14 * TestWebKitAPI/Tests/WebKit2/chinese-character-with-image.html: Added.
 15 * TestWebKitAPI/Tests/WebKit2/mac/AttributedSubstringForProposedRangeWithImage.mm: Added.
 16 (TestWebKitAPI::didFinishLoadForFrame):
 17 (TestWebKitAPI::processDidCrash):
 18 (TestWebKitAPI::invalidMessageFunction):
 19 (TestWebKitAPI::WebKit2.AttributedSubstringForProposedRangeWithImage):
 20
1212016-12-16 Wenson Hsieh <wenson_hsieh@apple.com>
222
323 Visual viewports: carets and selection UI are incorrectly positioned when editing fixed elements
209954

Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

449449 9B26FCCA159D16DE00CC3765 /* HTMLFormCollectionNamedItem.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9B26FCB4159D15E700CC3765 /* HTMLFormCollectionNamedItem.html */; };
450450 9B270FEE1DDC2C0B002D53F3 /* closed-shadow-tree-test.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9B270FED1DDC25FD002D53F3 /* closed-shadow-tree-test.html */; };
451451 9B4F8FA7159D52DD002D9F94 /* HTMLCollectionNamedItem.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9B4F8FA6159D52CA002D9F94 /* HTMLCollectionNamedItem.html */; };
 452 9BD4239A1E04BD9800200395 /* AttributedSubstringForProposedRangeWithImage.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9BD423991E04BD9800200395 /* AttributedSubstringForProposedRangeWithImage.mm */; };
 453 9BD4239C1E04C01C00200395 /* chinese-character-with-image.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9BD4239B1E04BFD000200395 /* chinese-character-with-image.html */; };
452454 9C64DC321D76198A004B598E /* YouTubePluginReplacement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9C64DC311D76198A004B598E /* YouTubePluginReplacement.cpp */; };
453455 A1146A8D1D2D7115000FE710 /* ContentFiltering.mm in Sources */ = {isa = PBXBuildFile; fileRef = A1146A8A1D2D704F000FE710 /* ContentFiltering.mm */; };
454456 A125478F1DB18B9400358564 /* LoadDataWithNilMIMEType.mm in Sources */ = {isa = PBXBuildFile; fileRef = A125478D1DB18B9400358564 /* LoadDataWithNilMIMEType.mm */; };

592594 dstPath = TestWebKitAPI.resources;
593595 dstSubfolderSpec = 7;
594596 files = (
 597 9BD4239C1E04C01C00200395 /* chinese-character-with-image.html in Copy Resources */,
595598 5110FCF91E01CD8A006F8D0B /* IndexUpgrade.blob in Copy Resources */,
596599 5110FCF61E01CD83006F8D0B /* IndexUpgrade.sqlite3 in Copy Resources */,
597600 5110FCF11E01CD64006F8D0B /* IDBIndexUpgradeToV2.html in Copy Resources */,

11161119 9B4F8FA3159D52B1002D9F94 /* HTMLCollectionNamedItem.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = HTMLCollectionNamedItem.mm; sourceTree = "<group>"; };
11171120 9B4F8FA6159D52CA002D9F94 /* HTMLCollectionNamedItem.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = HTMLCollectionNamedItem.html; sourceTree = "<group>"; };
11181121 9B79164F1BD89D0D00D50B8F /* FirstResponderScrollingPosition.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FirstResponderScrollingPosition.mm; sourceTree = "<group>"; };
 1122 9BD423991E04BD9800200395 /* AttributedSubstringForProposedRangeWithImage.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AttributedSubstringForProposedRangeWithImage.mm; sourceTree = "<group>"; };
 1123 9BD4239B1E04BFD000200395 /* chinese-character-with-image.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "chinese-character-with-image.html"; sourceTree = "<group>"; };
11191124 9C64DC311D76198A004B598E /* YouTubePluginReplacement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = YouTubePluginReplacement.cpp; sourceTree = "<group>"; };
11201125 A1146A8A1D2D704F000FE710 /* ContentFiltering.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ContentFiltering.mm; sourceTree = "<group>"; };
11211126 A125478D1DB18B9400358564 /* LoadDataWithNilMIMEType.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LoadDataWithNilMIMEType.mm; sourceTree = "<group>"; };

19071912 BC90977B125571AE00083756 /* Resources */ = {
19081913 isa = PBXGroup;
19091914 children = (
 1915 9BD4239B1E04BFD000200395 /* chinese-character-with-image.html */,
19101916 07492B391DF8ADA400633DE1 /* enumerateMediaDevices.html */,
19111917 C045F9461385C2F800C0F3CD /* 18-characters.html */,
19121918 1C2B81851C89252300A5529F /* Ahem.ttf */,

21242130 C0C5D3BB14598B6F00A802A6 /* mac */ = {
21252131 isa = PBXGroup;
21262132 children = (
 2133 9BD423991E04BD9800200395 /* AttributedSubstringForProposedRangeWithImage.mm */,
21272134 8349D3C11DB96DDA004A9F65 /* ContextMenuDownload.mm */,
21282135 BCAA485714A044D40088FAC4 /* EditorCommands.mm */,
21292136 C0C5D3BC14598B6F00A802A6 /* GetBackingScaleFactor.mm */,

26832690 buildActionMask = 2147483647;
26842691 files = (
26852692 2E7765CD16C4D80A00BA2BB1 /* mainIOS.mm in Sources */,
 2693 9BD4239A1E04BD9800200395 /* AttributedSubstringForProposedRangeWithImage.mm in Sources */,
26862694 7AD3FE8E1D76131200B169A4 /* TransformationMatrix.cpp in Sources */,
26872695 2E7765CF16C4D81100BA2BB1 /* mainMac.mm in Sources */,
26882696 );
209954

Tools/TestWebKitAPI/Tests/WebKit2/chinese-character-with-image.html

 1<!DOCTYPE html>
 2<html>
 3<meta http-equiv='content-type' content='text/html; charset=utf-8'>
 4<body>
 5<div contenteditable>
 6<p><br></p>
 7<p style="text-align: center; font-size: 15px;"><img src="icon.png">你</p>
 8<p>hello, world</p>
 9</div>
 10<script>
 11document.querySelector('div').focus();
 12getSelection().setPosition(document.querySelector('img').parentNode, 1);
 13</script>
 14</body>
 15</html>
nonexistent

Tools/TestWebKitAPI/Tests/WebKit2/mac/AttributedSubstringForProposedRangeWithImage.mm

 1/*
 2 * Copyright (C) 2016 Apple Inc. All rights reserved.
 3 *
 4 * Redistribution and use in source and binary forms, with or without
 5 * modification, are permitted provided that the following conditions
 6 * are met:
 7 * 1. Redistributions of source code must retain the above copyright
 8 * notice, this list of conditions and the following disclaimer.
 9 * 2. Redistributions in binary form must reproduce the above copyright
 10 * notice, this list of conditions and the following disclaimer in the
 11 * documentation and/or other materials provided with the distribution.
 12 *
 13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
 14 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 15 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
 17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 23 * THE POSSIBILITY OF SUCH DAMAGE.
 24 */
 25
 26#include "config.h"
 27#include "PlatformUtilities.h"
 28#include "PlatformWebView.h"
 29#include <WebKit/WKContextPrivate.h>
 30#include <WebKit/WKRetainPtr.h>
 31
 32@interface WKView ()
 33- (void)attributedSubstringForProposedRange:(NSRange)nsRange completionHandler:(void(^)(NSAttributedString *attrString, NSRange actualRange))completionHandlerPtr;
 34@end
 35
 36namespace TestWebKitAPI {
 37
 38static bool didFinishLoad = false;
 39static bool didFinishTest = false;
 40static bool didObserveWebProcessToCrash = false;
 41static bool didReceiveInvalidMessage = false;
 42
 43static void didFinishLoadForFrame(WKPageRef, WKFrameRef, WKTypeRef, const void*)
 44{
 45 didFinishLoad = true;
 46}
 47
 48static void processDidCrash(WKPageRef, const void*)
 49{
 50 didObserveWebProcessToCrash = true;
 51}
 52
 53static void invalidMessageFunction(WKStringRef messageName)
 54{
 55 didReceiveInvalidMessage = true;
 56}
 57
 58TEST(WebKit2, AttributedSubstringForProposedRangeWithImage)
 59{
 60 WKRetainPtr<WKContextRef> context(AdoptWK, Util::createContextWithInjectedBundle());
 61 WKRetainPtr<WKPageGroupRef> pageGroup(AdoptWK, WKPageGroupCreateWithIdentifier(Util::toWK("AttributedSubstringForProposedRangeWithImagePageGroup").get()));
 62 PlatformWebView webView(context.get(), pageGroup.get());
 63
 64 WKPageLoaderClientV0 loaderClient;
 65 memset(&loaderClient, 0, sizeof(loaderClient));
 66 loaderClient.base.version = 0;
 67 loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
 68 loaderClient.processDidCrash = processDidCrash;
 69 WKPageSetPageLoaderClient(webView.page(), &loaderClient.base);
 70
 71 WKContextSetInvalidMessageFunction(invalidMessageFunction);
 72
 73 WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("chinese-character-with-image", "html"));
 74 WKPageLoadURL(webView.page(), url.get());
 75 Util::run(&didFinishLoad);
 76
 77 [webView.platformView() attributedSubstringForProposedRange:NSMakeRange(0, 3) completionHandler: ^(NSAttributedString *attrString, NSRange actualRange) {
 78 didFinishTest = true;
 79 }];
 80
 81 Util::run(&didFinishTest);
 82 EXPECT_EQ(didObserveWebProcessToCrash, false);
 83 EXPECT_EQ(didReceiveInvalidMessage, false);
 84}
 85
 86} // namespace TestWebKitAPI
nonexistent