Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[macOS] Crash when inserting writing suggestions in an editable `disp…
…lay: grid` container https://bugs.webkit.org/show_bug.cgi?id=275426 rdar://129366300 Reviewed by Richard Robinson and Abrar Protyasha. Make writing suggestions robust in the case where the process of attaching the suggestions renderer to its parent in the render tree causes the parent to become destroyed. This can happen if, for instance, the renderer is being inserted underneath an anonymous renderer inside of a grid container like so: ``` <body> <div style="display: grid;" contenteditable></div> </body> ``` ...with render tree: ``` RenderBlock {HTML} at (0,0) RenderBody {BODY} at (8,8) RenderGrid {DIV} at (0,0) RenderBlock (anonymous) at (0,0) RenderText {#text} at (0,0) // <----- text before suggestion ``` As a result of inserting the renderer, `removeLeftoverAnonymousBlock()` will replace the parent renderer, which currently leads to a crash since we hold a `CheckedPtr` to it on the stack. Instead, gracefully handle this (and similar) scenarios by deploying `WeakPtr`, and clean up the writing suggestions renderer and return early in the case where the parent is destroyed after insertion. Test: editing/input/mac/inline-prediction-in-grid-container.html * LayoutTests/editing/input/mac/inline-prediction-in-grid-container-expected.txt: Added. * LayoutTests/editing/input/mac/inline-prediction-in-grid-container.html: Added. * Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.cpp: (WebCore::RenderTreeUpdater::GeneratedContent::updateWritingSuggestionsRenderer): Canonical link: https://commits.webkit.org/279986@main
- Loading branch information