Bug 180619 – iOS: Crash in Document::updateLayout() via Document::processViewport

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Ryosuke Niwa]

When the viewport configuration is updated via meta element,
the modern media controls can end up updating the layout and cause a crash.

This is a real bug since updateLayout can execute arbitrary author scripts.

[Ryosuke Niwa]

<rdar://problem/35717575>

[Ryosuke Niwa]

Created attachment 328904 [details]
Fixes the crash

[WebKit Commit Bot]

Comment on attachment 328904 [details]
Fixes the crash

Clearing flags on attachment: 328904

Committed r225723: <https://trac.webkit.org/changeset/225723>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Simon Fraser (smfr)]

Can we stop calling these crashes please.

[Ryosuke Niwa]

(In reply to Simon Fraser (smfr) from comment #5)
> Can we stop calling these crashes please.

These are crashes. If we don't crash it here, it would later down the line as a security bug.

[Darin Adler]

Comment on attachment 328904 [details]
Fixes the crash

View in context: https://bugs.webkit.org/attachment.cgi?id=328904&action=review

> Source/WebCore/html/HTMLMetaElement.h:43
> +    void didFinishInsertingNode();

This is missing the "final" keyword. I guess this is a downside of us using "final" instead of "override", because I think we would have gotten a warning about this if we were using "override" on any other function in this class.