[webkit-changes] [WebKit/WebKit] d3e0ce: [macOS] Crash when presenting a datalist dropdown ...

[Aditya Keerthi]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: d3e0ced4e0f153c656e4effc2920d7e82e0891eb
      https://github.com/WebKit/WebKit/commit/d3e0ced4e0f153c656e4effc2920d7e82e0891eb
  Author: Aditya Keerthi <akeerthi at apple.com>
  Date:   2023-07-31 (Mon, 31 Jul 2023)

  Changed paths:
    A LayoutTests/fast/forms/datalist/datalist-dropdown-transformed-element-crash-expected.txt
    A LayoutTests/fast/forms/datalist/datalist-dropdown-transformed-element-crash.html
    M Source/WebKit/UIProcess/mac/WebDataListSuggestionsDropdownMac.mm

  Log Message:
  -----------
  [macOS] Crash when presenting a datalist dropdown for a transformed element
https://bugs.webkit.org/show_bug.cgi?id=256029
rdar://105190475

Reviewed by Wenson Hsieh.

AppKit throws an exception when an `NSWindow` is constructed with an
invalid frame. The `<datalist>` dropdown is an `NSWindow` with a frame derived
from the rect of its associated element. When this element is off-screen or
abnormally large, the frame used for the window may be invalid.

Fix by ensuring the frame can never be outside the screen.

* LayoutTests/fast/forms/datalist/datalist-dropdown-transformed-element-crash-expected.txt: Added.
* LayoutTests/fast/forms/datalist/datalist-dropdown-transformed-element-crash.html: Added.
* Source/WebKit/UIProcess/mac/WebDataListSuggestionsDropdownMac.mm:
(-[WKDataListSuggestionsController dropdownRectForElementRect:]):

1. Use the presenting window's screen, rather than the main screen for correctness.
2. Take the intersection of the screen's visible frame and the element's visible frame to avoid using an invalid rect.
3. Ensure the minimum origin of the window is (0, 0).

Originally-landed-as: 259548.702 at safari-7615-branch (d7114d64c320). rdar://105190475
Canonical link: https://commits.webkit.org/266448@main