Skip to content

Commit 883886e

Browse files
alanbaradlayalanbaradlay
committed
Crash under RenderObject::createVisiblePosition() while dragging the volume scrubber on a video player
https://bugs.webkit.org/show_bug.cgi?id=275469 <rdar://129080145> Reviewed by Antti Koivisto. 1. In EventHandler::mouseDragged we dispatch the "mouse move" event 2. JS triggers some mutation which makes the tree dirty 3. later in EventHandler::handleMouseMoveEvent() we call EventHandler::handleMouseDraggedEvent() (tree is dirty) which, through a few layers of functions calls VisiblePosition::canonicalPosition() 4. VisiblePosition::canonicalPosition() needs a clean tree so it calls Document::updateLayout() which is turn destroys some renderers (see #2) 5. In-between EventHandler::handleMouseDraggedEvent() and VisiblePosition::canonicalPosition(), we CheckPtr a renderer which gets destroyed at #4. The fix (what we normally do with cases like this) is to make sure we clean the tree before entering VisiblePosition. * Source/WebCore/page/EventHandler.cpp: (WebCore::EventHandler::handleMouseDraggedEvent): Canonical link: https://commits.webkit.org/280013@main
1 parent b4480d0 commit 883886e

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

‎Source/WebCore/page/EventHandler.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -964,7 +964,8 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
964964
frame->protectedDocument()->hitTest(HitTestRequest(), result);
965965

966966
updateSelectionForMouseDrag(result);
967-
}
967+
} else
968+
event.targetNode()->protectedDocument()->updateStyleIfNeeded();
968969
updateSelectionForMouseDrag(event.hitTestResult());
969970
return true;
970971
}

0 commit comments

Comments
 (0)