Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Crash under ~RenderMenuList due to CheckedPtr usage #24372

Merged
merged 1 commit into from
Feb 13, 2024
Merged

Crash under ~RenderMenuList due to CheckedPtr usage #24372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions Source/WebCore/html/HTMLSelectElement.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1145,7 +1145,7 @@ bool HTMLSelectElement::platformHandleKeydownEvent(KeyboardEvent* event)
// Calling focus() may cause us to lose our renderer. Return true so
// that our caller doesn't process the event further, but don't set
// the event as handled.
CheckedPtr renderer = dynamicDowncast<RenderMenuList>(this->renderer());
WeakPtr renderer = dynamicDowncast<RenderMenuList>(this->renderer());
if (!renderer)
return true;

Expand All @@ -1154,7 +1154,7 @@ bool HTMLSelectElement::platformHandleKeydownEvent(KeyboardEvent* event)
// gets called from RenderMenuList::valueChanged, which gets called
// after the user makes a selection from the menu.
saveLastSelection();
renderer->showPopup();
renderer->showPopup(); // showPopup() may run JS and cause the renderer to get destroyed.
event->setDefaultHandled();
}
return true;
Expand Down Expand Up @@ -1244,7 +1244,7 @@ void HTMLSelectElement::menuListDefaultEventHandler(Event& event)
protectedDocument()->updateStyleIfNeeded();

// Calling focus() may remove the renderer or change the renderer type.
CheckedPtr renderer = dynamicDowncast<RenderMenuList>(this->renderer());
WeakPtr renderer = dynamicDowncast<RenderMenuList>(this->renderer());
if (!renderer)
return;

Expand All @@ -1253,7 +1253,7 @@ void HTMLSelectElement::menuListDefaultEventHandler(Event& event)
// gets called from RenderMenuList::valueChanged, which gets called
// after the user makes a selection from the menu.
saveLastSelection();
renderer->showPopup();
renderer->showPopup(); // showPopup() may run JS and cause the renderer to get destroyed.
handled = true;
}
} else if (RenderTheme::singleton().popsMenuByArrowKeys()) {
Expand All @@ -1262,7 +1262,7 @@ void HTMLSelectElement::menuListDefaultEventHandler(Event& event)
protectedDocument()->updateStyleIfNeeded();

// Calling focus() may remove the renderer or change the renderer type.
CheckedPtr renderer = dynamicDowncast<RenderMenuList>(this->renderer());
WeakPtr renderer = dynamicDowncast<RenderMenuList>(this->renderer());
if (!renderer)
return;

Expand All @@ -1271,7 +1271,7 @@ void HTMLSelectElement::menuListDefaultEventHandler(Event& event)
// gets called from RenderMenuList::valueChanged, which gets called
// after the user makes a selection from the menu.
saveLastSelection();
renderer->showPopup();
renderer->showPopup(); // showPopup() may run JS and cause the renderer to get destroyed.
handled = true;
} else if (keyCode == '\r') {
if (RefPtr form = this->form())
Expand All @@ -1290,15 +1290,15 @@ void HTMLSelectElement::menuListDefaultEventHandler(Event& event)
#if !PLATFORM(IOS_FAMILY)
protectedDocument()->updateStyleIfNeeded();

if (CheckedPtr menuList = dynamicDowncast<RenderMenuList>(renderer())) {
if (WeakPtr menuList = dynamicDowncast<RenderMenuList>(renderer())) {
ASSERT(!menuList->popupIsVisible());
// Save the selection so it can be compared to the new
// selection when we call onChange during selectOption,
// which gets called from RenderMenuList::valueChanged,
// which gets called after the user makes a selection from
// the menu.
saveLastSelection();
menuList->showPopup();
menuList->showPopup(); // showPopup() may run JS and cause the renderer to get destroyed.
}
#endif
event.setDefaultHandled();
Expand Down Expand Up @@ -1696,8 +1696,8 @@ ExceptionOr<void> HTMLSelectElement::showPicker()
return Exception { ExceptionCode::NotAllowedError, "Select showPicker() requires a user gesture."_s };

#if !PLATFORM(IOS_FAMILY)
if (CheckedPtr renderMenuList = dynamicDowncast<RenderMenuList>(renderer()))
renderMenuList->showPopup();
if (WeakPtr renderMenuList = dynamicDowncast<RenderMenuList>(renderer()))
renderMenuList->showPopup(); // showPopup() may run JS and cause the renderer to get destroyed.
#endif

return { };
Expand Down
2 changes: 1 addition & 1 deletion Source/WebCore/rendering/RenderMenuList.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,7 +384,7 @@ void RenderMenuList::showPopup()
FloatPoint absTopLeft = localToAbsolute(FloatPoint(), UseTransforms);
IntRect absBounds = absoluteBoundingBoxRectIgnoringTransforms();
absBounds.setLocation(roundedIntPoint(absTopLeft));
m_popup->show(absBounds, &view().frameView(), selectElement().optionToListIndex(selectElement().selectedIndex()));
m_popup->show(absBounds, &view().frameView(), selectElement().optionToListIndex(selectElement().selectedIndex())); // May destroy `this`.
}
#endif

Expand Down