Bug 207899

Summary: [macOS] Web process may crash under ServicesOverlayController::buildPotentialHighlightsIfNeeded
Product: WebKit Reporter: Wenson Hsieh <wenson_hsieh>
Component: HTML EditingAssignee: Wenson Hsieh <wenson_hsieh>
Status: RESOLVED FIXED    
Severity: Normal CC: bdakin, commit-queue, ddkilzer, rniwa, simon.fraser, thorton, webkit-bug-importer, wenson_hsieh
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
v2 thorton: review+, wenson_hsieh: commit-queue-

Description Wenson Hsieh 2020-02-18 10:51:52 PST
<rdar://problem/55658207>
Comment 1 Wenson Hsieh 2020-02-18 11:01:45 PST Comment hidden (obsolete)
Comment 2 Wenson Hsieh 2020-02-18 11:34:30 PST
Ah....it looks like my new test crashes on iOS :(

Going to augment my patch to fix this as well.
Comment 3 Wenson Hsieh 2020-02-18 11:37:10 PST
Created attachment 391072 [details]
v2
Comment 4 Simon Fraser (smfr) 2020-02-18 14:44:57 PST
Comment on attachment 391072 [details]
v2

View in context: https://bugs.webkit.org/attachment.cgi?id=391072&action=review

> Source/WebCore/page/mac/ServicesOverlayController.mm:547
>          FrameView* viewForRange = selectionRange->ownerDocument().view();

We usually do RefPtr<FrameView> these days.
Comment 5 Wenson Hsieh 2020-02-18 14:53:40 PST
Comment on attachment 391072 [details]
v2

View in context: https://bugs.webkit.org/attachment.cgi?id=391072&action=review

>> Source/WebCore/page/mac/ServicesOverlayController.mm:547
>>          FrameView* viewForRange = selectionRange->ownerDocument().view();
> 
> We usually do RefPtr<FrameView> these days.

Sure, I’ll ref this (I originally wanted to avoid making any changes that weren’t necessary to fix the crash, but I guess my WebPageIOS change makes this point moot anyways :/)
Comment 6 Wenson Hsieh 2020-02-18 15:15:48 PST
Committed r256859: <https://trac.webkit.org/changeset/256859>