[webkit-changes] [WebKit/WebKit] b72851: Occasional crash under WebPage::sendEditorStateUpd...

[Wenson Hsieh]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: b72851e83e5aec900b8d6a49d6be0614e3e6f586
      https://github.com/WebKit/WebKit/commit/b72851e83e5aec900b8d6a49d6be0614e3e6f586
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2023-07-06 (Thu, 06 Jul 2023)

  Changed paths:
    M Source/WebCore/editing/Editor.cpp
    M Source/WebCore/loader/EmptyClients.cpp
    M Source/WebCore/page/EditorClient.h
    M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm
    M Tools/TestWebKitAPI/Tests/ios/KeyboardInputTestsIOS.mm

  Log Message:
  -----------
  Occasional crash under WebPage::sendEditorStateUpdate() when discarding IME composition
https://bugs.webkit.org/show_bug.cgi?id=258942
rdar://111258989

Reviewed by Tim Horton.

Address a web content process crash, wherein we attempt to access `Page::m_focusController` once it
has already been cleared out. This can occur when a page in the page cache is destroyed, while it
still contains an active IME composition (i.e. `Editor::m_compositionNode` is non-null).

Mitigate this by only computing and sending an editor state update in this case, if the `Document`
containing the marked text range has a living render tree. To do this, we refactor the
`discardedComposition` `EditorClient` hook to pass a `const Document&` instead of a `Frame*` (the
latter of which ends up being null at this point during page destruction), and use it to return
early in `WebPage::discardedComposition` to avoid the crash.

Test: KeyboardInputTests.NoCrashWhenDiscardingMarkedText

* Source/WebCore/editing/Editor.cpp:
(WebCore::Editor::clear):
(WebCore::Editor::confirmOrCancelCompositionAndNotifyClient):
* Source/WebCore/loader/EmptyClients.cpp:
* Source/WebCore/page/EditorClient.h:
* Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::discardedComposition):
* Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::didChangeSelectionOrOverflowScrollPosition):
(WebKit::WebPage::discardedComposition):
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.h:
* Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::discardedComposition):
* Tools/TestWebKitAPI/Tests/ios/KeyboardInputTestsIOS.mm:
(TestWebKitAPI::TEST):

Canonical link: https://commits.webkit.org/265821@main