Bug 113377 – [Chromium] REGRESSION(r88030): Right-click on invalid form controls unexpectedly dispatches 'invalid' events

• Status: RESOLVED
• Resolution: FIXED
• Component: Forms

[Kent Tamura]

https://code.google.com/p/chromium/issues/detail?id=126386 (Note: this report doesn't mention possibility of crashes.)
http://trac.webkit.org/changeset/88030

In the preparation code of context menu,

        HTMLFormElement* form = selectedFrame->selection()->currentForm();
        if (form && form->checkValidity() && r.innerNonSharedNode()->hasTagName(HTMLNames::inputTag)) {
            HTMLInputElement* selectedElement = static_cast<HTMLInputElement*>(r.innerNonSharedNode());
            if (selectedElement) {
                WebSearchableFormData ws = WebSearchableFormData(WebFormElement(form), WebInputElement(selectedElement));

form->checkValidity() can dispatch 'invalid' events, and the 'form' object can be removed in event handlers.

[Kent Tamura]

Created attachment 195252 [details]
Patch

[Kent Tamura]

Comment on attachment 195252 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=195252&action=review

> Source/WebKit/chromium/src/ContextMenuClientImpl.cpp:341
> -        if (form && form->checkValidity() && r.innerNonSharedNode()->hasTagName(HTMLNames::inputTag)) {
> +        if (form && r.innerNonSharedNode()->hasTagName(HTMLNames::inputTag)) {

I think we have no reason to call checkValidity here, and functions dispatching events should not be called during context menu preparation.

[Kent Tamura]

Ah, I found this didn't cause use-after-free.  If form->checkValidity() dispatches 'invalid' events, it returns false. So 'form' won't be accessed in such case. If form->checkValidity() returns true, it won't dispatch events and accessing 'form' is safe.

[WebKit Review Bot]

Comment on attachment 195252 [details]
Patch

Clearing flags on attachment: 195252

Committed r147161: <http://trac.webkit.org/changeset/147161>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.