<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[196445] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/196445">196445</a></dd>
<dt>Author</dt> <dd>enrica@apple.com</dd>
<dt>Date</dt> <dd>2016-02-11 15:04:13 -0800 (Thu, 11 Feb 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>WebContent process crashes when performing data detection on content with existing data detector links.
https://bugs.webkit.org/show_bug.cgi?id=154118
rdar://problem/24511860
Reviewed by Tim Horton.
The DOM mutation caused by removing the existing links, can shift the range endpoints.
We now save the range enpoints as positions so that we can recreate the ranges,
if a DOM mutation occurred.
* editing/cocoa/DataDetection.mm:
(WebCore::removeResultLinksFromAnchor):
(WebCore::searchForLinkRemovingExistingDDLinks):
(WebCore::DataDetection::detectContentInRange):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreeditingcocoaDataDetectionmm">trunk/Source/WebCore/editing/cocoa/DataDetection.mm</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (196444 => 196445)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-02-11 23:01:39 UTC (rev 196444)
+++ trunk/Source/WebCore/ChangeLog 2016-02-11 23:04:13 UTC (rev 196445)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2016-02-11 Enrica Casucci <enrica@apple.com>
+
+ WebContent process crashes when performing data detection on content with existing data detector links.
+ https://bugs.webkit.org/show_bug.cgi?id=154118
+ rdar://problem/24511860
+
+ Reviewed by Tim Horton.
+
+ The DOM mutation caused by removing the existing links, can shift the range endpoints.
+ We now save the range enpoints as positions so that we can recreate the ranges,
+ if a DOM mutation occurred.
+
+ * editing/cocoa/DataDetection.mm:
+ (WebCore::removeResultLinksFromAnchor):
+ (WebCore::searchForLinkRemovingExistingDDLinks):
+ (WebCore::DataDetection::detectContentInRange):
+
</ins><span class="cx"> 2016-02-11 Jer Noble <jer.noble@apple.com>
</span><span class="cx">
</span><span class="cx"> Make MediaResourceLoader behave more like a CachedResourceLoader.
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingcocoaDataDetectionmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/cocoa/DataDetection.mm (196444 => 196445)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/cocoa/DataDetection.mm 2016-02-11 23:01:39 UTC (rev 196444)
+++ trunk/Source/WebCore/editing/cocoa/DataDetection.mm 2016-02-11 23:04:13 UTC (rev 196445)
</span><span class="lines">@@ -240,14 +240,16 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static bool searchForLinkRemovingExistingDDLinks(Node* startNode, Node* endNode)
</del><ins>+static bool searchForLinkRemovingExistingDDLinks(Node* startNode, Node* endNode, bool &didModifyDOM)
</ins><span class="cx"> {
</span><ins>+ didModifyDOM = false;
</ins><span class="cx"> Node *node = startNode;
</span><span class="cx"> while (node) {
</span><span class="cx"> if (is<HTMLAnchorElement>(*node)) {
</span><span class="cx"> if (downcast<Element>(*node).getAttribute(dataDetectorsURLScheme) != "true")
</span><span class="cx"> return true;
</span><span class="cx"> removeResultLinksFromAnchor(node, node->parentElement());
</span><ins>+ didModifyDOM = true;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (node == endNode) {
</span><span class="lines">@@ -259,6 +261,7 @@
</span><span class="cx"> if (downcast<Element>(*node).getAttribute(dataDetectorsURLScheme) != "true")
</span><span class="cx"> return true;
</span><span class="cx"> removeResultLinksFromAnchor(node, node->parentElement());
</span><ins>+ didModifyDOM = true;
</ins><span class="cx"> }
</span><span class="cx"> node = node->parentNode();
</span><span class="cx"> }
</span><span class="lines">@@ -520,10 +523,25 @@
</span><span class="cx">
</span><span class="cx"> NSString *identifier = dataDetectorStringForPath(indexPaths[resultIndex].get());
</span><span class="cx"> NSString *correspondingURL = constructURLStringForResult(coreResult, identifier, referenceDate, (NSTimeZone *)tz, types);
</span><ins>+ bool didModifyDOM = false;
</ins><span class="cx">
</span><del>- if (!correspondingURL || searchForLinkRemovingExistingDDLinks(&resultRanges.first()->startContainer(), &resultRanges.last()->endContainer()))
</del><ins>+ // Store the range boundaries as Position, because the DOM could change if we find
+ // old data detector link.
+ Vector<std::pair<Position, Position>> rangeBoundaries;
+ for (auto& range : resultRanges)
+ rangeBoundaries.append(std::make_pair(range->startPosition(), range->endPosition()));
+
+ if (!correspondingURL || searchForLinkRemovingExistingDDLinks(&resultRanges.first()->startContainer(), &resultRanges.last()->endContainer(), didModifyDOM))
</ins><span class="cx"> continue;
</span><span class="cx">
</span><ins>+ if (didModifyDOM) {
+ // If the DOM was modified because some old links were removed,
+ // we need to recreate the ranges because they could no longer be valid.
+ resultRanges.clear();
+ for (auto& rangeBoundary : rangeBoundaries)
+ resultRanges.append(Range::create(*rangeBoundary.first.document(), rangeBoundary.first, rangeBoundary.second));
+ }
+
</ins><span class="cx"> lastModifiedQueryOffset = queryRange.end;
</span><span class="cx">
</span><span class="cx"> for (auto& range : resultRanges) {
</span></span></pre>
</div>
</div>
</body>
</html>