Bug 192113 – [iOSMac] Dropping text selections from web content into editable elements crashes the web process

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[Wenson Hsieh]

SSIA

[Radar WebKit Bug Importer]

<rdar://problem/46323701>

[Wenson Hsieh]

(In reply to Wenson Hsieh from comment #0)
> SSIA

On second thought, there's a bit more to say here :| The following interactions either crash the web process or fail silently:

• Drag text selection from iOSMac and drop into a web view in macOS.
• Drag text selection from a web view in macOS and drop into an editable area in iOSMac.
• Drag and drop within editable areas in iOSMac.

[Wenson Hsieh]

Created attachment 355935 [details]
Patch

[Ryosuke Niwa]

Comment on attachment 355935 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=355935&action=review

> Source/WebCore/ChangeLog:9
> +        In iOSMac, registering invalid UTIs on NSItemProvider when starting a drag or handling a drop fails gracefully.

You mean this doesn't fail gracefully???

> Source/WebCore/platform/ios/PasteboardIOS.mm:200
> -    if ([type isEqualToString:(NSString *)kUTTypeFlatRTFD]) {
> +    if ([type isEqualToString:(__bridge NSString *)kUTTypeFlatRTFD]) {

Can we compile out this code in iOSMac?

[Ryosuke Niwa]

We should make sure we never try to read RTF / FlatRTF even when there is no WebArchive though.

[Wenson Hsieh]

Comment on attachment 355935 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=355935&action=review

>> Source/WebCore/ChangeLog:9
>> +        In iOSMac, registering invalid UTIs on NSItemProvider when starting a drag or handling a drop fails gracefully.
> 
> You mean this doesn't fail gracefully???

Ah, I just meant it fails but doesn't cause a crash or throw an exception. I'll reword to make this clearer.

>> Source/WebCore/platform/ios/PasteboardIOS.mm:200
>> +    if ([type isEqualToString:(__bridge NSString *)kUTTypeFlatRTFD]) {
> 
> Can we compile out this code in iOSMac?

Yep! As we discussed, I'll also add a RELEASE_ASSERT in the codepath where we attempt to use UIFoundation to try and convert an attributed string to markup.

[Wenson Hsieh]

(In reply to Wenson Hsieh from comment #6)
> Comment on attachment 355935 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=355935&action=review
> 
> >> Source/WebCore/ChangeLog:9
> >> +        In iOSMac, registering invalid UTIs on NSItemProvider when starting a drag or handling a drop fails gracefully.
> > 
> > You mean this doesn't fail gracefully???
> 
> Ah, I just meant it fails but doesn't cause a crash or throw an exception.
> I'll reword to make this clearer.
> 
> >> Source/WebCore/platform/ios/PasteboardIOS.mm:200
> >> +    if ([type isEqualToString:(__bridge NSString *)kUTTypeFlatRTFD]) {
> > 
> > Can we compile out this code in iOSMac?
> 
> Yep! As we discussed, I'll also add a RELEASE_ASSERT in the codepath where
> we attempt to use UIFoundation to try and convert an attributed string to
> markup.

(Actually, I think it makes more sense to just guard out the call site on iOSMac, so that it just fails gracefully instead of crashing.)

[Wenson Hsieh]

Created attachment 355967 [details]
Patch for EWS

[Wenson Hsieh]

Created attachment 355970 [details]
Patch for EWS

[WebKit Commit Bot]

Comment on attachment 355970 [details]
Patch for EWS

Clearing flags on attachment: 355970

Committed r238661: <https://trac.webkit.org/changeset/238661>