_web_makePluginViewsPerformSelector:: mutates subviews array while iterating it

• Component: Plug-ins
• Status: RESOLVED FIXED

[John Sullivan]

This is in Radar as <rdar://problem/8395558>

The method -[NSArray _web_makePluginViewsPerformSelector:withObject:], which is implemented in WebHTMLView.mm, uses -[NSArray objectEnumerator] to enumerate the receiver array. The two callers to this method both send it to [self subviews]. [NSView subviews] returns the "live" mutable NSArray holding a view's subviews, so if the selector causes the view's subviews to change, the array will be mutated while it's being enumerated, which is an ObjC no-no that causes an NSException to be thrown (and ensuing havoc).

[John Sullivan]

Created attachment 67870 [details]
Patch to avoid mutating array while enumerating it.

[Darin Adler]

Comment on attachment 67870 [details]
Patch to avoid mutating array while enumerating it.

Historically, objectEnumerator creating a copy of the entire array! I’m surprised that it has changed so that it no longer does so.

Does this work properly when there are no subviews?

Instead of initWithArray: you could have used the copy method.

r=me

[John Sullivan]

The fast enumeration introduced with ObjC-2.0 is used with objectEnumerator; that's when the prohibition against mutating a collection while enumerating it began. Other bugs like this have been fixed in WebKit, though maybe the others were all a long time ago (e.g. <http://trac.webkit.org/changeset/24827>).

initWithArray: will return an empty array when passed nil, but the documentation is not clear about this. -copy will call -initWithArray:, but I guess it's a little bit better because it's unambiguous about what you'll get with a nil initial array, so I'll switch to using that.

Thanks for reviewing!

[John Sullivan]

Fixed in r67691.