FrameSelection::appearanceUpdateTimerFired should be robust against layout passes...
authorwenson_hsieh@apple.com <wenson_hsieh@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 29 Mar 2018 23:05:06 +0000 (23:05 +0000)
committerwenson_hsieh@apple.com <wenson_hsieh@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 29 Mar 2018 23:05:06 +0000 (23:05 +0000)
commit28e47d722a4f23c72a3c9e7453c6ca91f2f070d5
tree050cced8e9db692b82695cd502f6d7c571ef0688
parent86a6b35dd72abc5ef1e2570af3bd5ed16651aefe
FrameSelection::appearanceUpdateTimerFired should be robust against layout passes underneath it
https://bugs.webkit.org/show_bug.cgi?id=183395
<rdar://problem/38055732>

Reviewed by Zalan Bujtas.

Source/WebCore:

In the case where a FrameSelection updates its appearance when m_appearanceUpdateTimer is fired, the
FrameSelection's Frame is unprotected, and can be removed by arbitrary script. This patch applies a simple
mitigation by wrapping the Frame in a Ref when firing the appearance update timer, and ensuring that layout is
really up to date before calling updateAppearanceAfterLayoutOrStyleChange() from the timer.

Test: editing/selection/iframe-update-selection-appearance.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::appearanceUpdateTimerFired):

LayoutTests:

Add a new layout test that passes if we didn't crash.

* editing/selection/iframe-update-selection-appearance-expected.txt: Added.
* editing/selection/iframe-update-selection-appearance.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230087 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/editing/selection/iframe-update-selection-appearance-expected.txt [new file with mode: 0644]
LayoutTests/editing/selection/iframe-update-selection-appearance.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/editing/FrameSelection.cpp