Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange()
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 8 Mar 2018 03:51:33 +0000 (03:51 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 8 Mar 2018 03:51:33 +0000 (03:51 +0000)
https://bugs.webkit.org/show_bug.cgi?id=183385
<rdar://problem/38085397>

Reviewed by Antti Koivisto.

Source/WebCore:

When HTMLInputElement::updateType() is called with a dirty value, we eagerly change the m_inputType first
and then we take care of the dirty value by calling setAttributeWithoutSynchronization().
With a DOMSubtreeModified event listener attached, setAttributeWithoutSynchronization() can end up running some
layout code (offsetHeight) with a renderer - m_inputType mismatch.

This patch ensures that we don't change the m_inputType until after we finished setting the new value.

Test: fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::updateType):

LayoutTests:

* fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt: Added.
* fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229393 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/HTMLInputElement.cpp

index 7c7b7dc..f45a6cb 100644 (file)
@@ -1,3 +1,14 @@
+2018-03-07  Zalan Bujtas  <zalan@apple.com>
+
+        Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange()
+        https://bugs.webkit.org/show_bug.cgi?id=183385
+        <rdar://problem/38085397>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt: Added.
+        * fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html: Added.
+
 2018-03-06  Ryan Haddad  <ryanhaddad@apple.com>
 
         Update TestExpectations for media/modern-media-controls/fullscreen-support/fullscreen-support-press.html.
diff --git a/LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt b/LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt
new file mode 100644 (file)
index 0000000..b0d5e48
--- /dev/null
@@ -0,0 +1 @@
+ Pass if no crash.
diff --git a/LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html b/LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html
new file mode 100644 (file)
index 0000000..d5c782b
--- /dev/null
@@ -0,0 +1,16 @@
+<input id=input>
+Pass if no crash.
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+    
+function eventhandler() {
+    document.body.offsetHeight;
+}
+
+input.addEventListener("DOMSubtreeModified", eventhandler);
+document.execCommand("selectAll", true);
+
+input.value = "foobar";
+input.type = "button";
+</script>
index d72178a..0db9f72 100644 (file)
@@ -1,3 +1,23 @@
+2018-03-07  Zalan Bujtas  <zalan@apple.com>
+
+        Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange()
+        https://bugs.webkit.org/show_bug.cgi?id=183385
+        <rdar://problem/38085397>
+
+        Reviewed by Antti Koivisto.
+
+        When HTMLInputElement::updateType() is called with a dirty value, we eagerly change the m_inputType first
+        and then we take care of the dirty value by calling setAttributeWithoutSynchronization().
+        With a DOMSubtreeModified event listener attached, setAttributeWithoutSynchronization() can end up running some
+        layout code (offsetHeight) with a renderer - m_inputType mismatch.
+
+        This patch ensures that we don't change the m_inputType until after we finished setting the new value.
+
+        Test: fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType):
+
 2018-03-07  Chris Dumez  <cdumez@apple.com>
 
         Get rid of custom bindings for History's replaceState() / pushState()
index b8f12ce..eb64ccc 100644 (file)
@@ -491,10 +491,16 @@ void HTMLInputElement::updateType()
     removeFromRadioButtonGroup();
 
     bool didStoreValue = m_inputType->storesValueSeparateFromAttribute();
+    bool willStoreValue = newType->storesValueSeparateFromAttribute();
     bool neededSuspensionCallback = needsSuspensionCallback();
     bool didRespectHeightAndWidth = m_inputType->shouldRespectHeightAndWidthAttributes();
     bool wasSuccessfulSubmitButtonCandidate = m_inputType->canBeSuccessfulSubmitButton();
 
+    if (didStoreValue && !willStoreValue && hasDirtyValue()) {
+        setAttributeWithoutSynchronization(valueAttr, m_valueIfDirty);
+        m_valueIfDirty = String();
+    }
+
     m_inputType->destroyShadowSubtree();
 
     m_inputType = WTFMove(newType);
@@ -503,12 +509,6 @@ void HTMLInputElement::updateType()
 
     setNeedsWillValidateCheck();
 
-    bool willStoreValue = m_inputType->storesValueSeparateFromAttribute();
-
-    if (didStoreValue && !willStoreValue && hasDirtyValue()) {
-        setAttributeWithoutSynchronization(valueAttr, m_valueIfDirty);
-        m_valueIfDirty = String();
-    }
     if (!didStoreValue && willStoreValue)
         m_valueIfDirty = sanitizeValue(attributeWithoutSynchronization(valueAttr));
     else