215622 2020-08-18 13:39:14 -0700 REGRESSION(r265092): delegatesFocus causes WebKit to crash 2020-10-28 11:29:01 -0700 1 1 1 Unclassified WebKit DOM Safari Technology Preview All Other RESOLVED FIXED InRadar P2 Normal --- 148695 1 ldebeasi rniwa caleb.d.williams cdumez gsnedders koivisto lizmitchell niklasmerz overbek rniwa webkit-bug-importer webkitbugzilla wenson_hsieh youennf oldest_to_newest 1681162 0 406804 ldebeasi 2020-08-18 13:39:14 -0700 Created attachment 406804 Code Reproduction As of iOS 14 beta 5 and STP 112, clicking an element that has delegatesFocus set on its shadow root causes WebKit to crash. This only happens when there is no element inside of the component to forward focus to. Adding a focusable element, such as an input, fixes the issue. Steps to reproduce: 1. Open attached reproduction file on a device running iOS 14 beta 5 or STP 112. 2. Click/Tap the "Clicking me will cause a crash" text. 3. Notice that the browser reloads. Clicking again gives the "A problem repeatedly occurred" error. 4. Click/Tap the "Clicking me will NOT cause a crash" text. 5. Notice that the browser does NOT reload. This is because there is an input that delegatesFocus can forward focus to. Expected Behavior: I would expect that WebKit does not crash when clicking an element with delegatesFocus. Actual Behavior: WebKit crashes when clicking an element with delegatesFocus. 1681175 1 gsnedders 2020-08-18 14:08:33 -0700 r265092 looks suspicious here. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff3a81ff5b WebCore::EventHandler::dispatchMouseEvent(WTF::AtomString const&, WebCore::Node*, int, WebCore::PlatformMouseEvent const&, WebCore::EventHandler::FireMouseOverOut) + 2683 1 com.apple.WebCore 0x00007fff38f45e6f WebCore::EventHandler::handleMousePressEvent(WebCore::PlatformMouseEvent const&) + 3327 2 com.apple.WebKit 0x00007fff3b5cac3b WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&) + 451 3 com.apple.WebKit 0x00007fff3bbbe127 WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) + 11385 4 com.apple.WebKit 0x00007fff3b64a075 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 125 5 com.apple.WebKit 0x00007fff3baa123a WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 28 is the top of the crash 1681176 2 webkit-bug-importer 2020-08-18 14:08:47 -0700 <rdar://problem/67351846> 1681302 3 406830 rniwa 2020-08-18 23:56:28 -0700 Created attachment 406830 Fixes the crash 1681415 4 rniwa 2020-08-19 11:14:52 -0700 Committed r265881: <https://trac.webkit.org/changeset/265881> 1682195 5 ap 2020-08-22 16:10:04 -0700 *** Bug 215732 has been marked as a duplicate of this bug. *** 1682363 6 407108 lizmitchell 2020-08-24 10:07:40 -0700 Created attachment 407108 Crash with focusable button Following up on this bug, STP 112 also crashed when clicking an element in a component that had a focusable element (a button). I'm curious if the implementation does not consider the button element focusable. After the patch, does clicking the text in the new attachment focus the button element? 1682411 7 rniwa 2020-08-24 11:37:26 -0700 (In reply to Liz Mitchell from comment #6) > Created attachment 407108 [details] > Crash with focusable button > > Following up on this bug, STP 112 also crashed when clicking an element in a > component that had a focusable element (a button). > > I'm curious if the implementation does not consider the button element > focusable. After the patch, does clicking the text in the new attachment > focus the button element? Buttons are not focusable in macOS / iOS WebKit per OS convention. That's the bug 118043. 1689925 8 lizmitchell 2020-09-18 12:47:47 -0700 Safari 14.0 (15610.1.28.1.9) on Desktop released September 16, 2020 does not have this fix applied. This is causing production breakages with our components on Safari for users that upgrade from Safari 13 to 14 with the latest OS X updates. 1692718 9 rniwa 2020-09-28 17:11:34 -0700 (In reply to Liz Mitchell from comment #8) > Safari 14.0 (15610.1.28.1.9) on Desktop released September 16, 2020 does not > have this fix applied. > > This is causing production breakages with our components on Safari for users > that upgrade from Safari 13 to 14 with the latest OS X updates. Please try the latest beta of macOS Big Sir or Safari 14. 1693071 10 lizmitchell 2020-09-29 12:13:26 -0700 (In reply to Ryosuke Niwa from comment #9) > Please try the latest beta of macOS Big Sir or Safari 14. I'm unable to update past macOS Big Sur due to corp policy right now, but Safari TP Release 113 on macOS Catalina was confirmed to resolve this issue. The problem is that a recent app store update to Safari on Catalina updated Safari from 13 to 14 without the latest WebKit changes (pre-Release 113). This has caused multiple users to report production breakages as macOS Catalina updates their Safari app to v14 with this regression. 1693075 11 rniwa 2020-09-29 12:18:25 -0700 (In reply to Liz Mitchell from comment #10) > (In reply to Ryosuke Niwa from comment #9) > > Please try the latest beta of macOS Big Sir or Safari 14. > > I'm unable to update past macOS Big Sur due to corp policy right now, but > Safari TP Release 113 on macOS Catalina was confirmed to resolve this issue. > > The problem is that a recent app store update to Safari on Catalina updated > Safari from 13 to 14 without the latest WebKit changes (pre-Release 113). > > This has caused multiple users to report production breakages as macOS > Catalina updates their Safari app to v14 with this regression. I understand and we're aware of the issue. We're not going to recede Safari 14 for this issue alone though. Having said that, what ships to macOS Big Sur will ship to macOS Catalina and macOS Mojave. 1702407 12 smoley 2020-10-28 11:29:01 -0700 *** Bug 218290 has been marked as a duplicate of this bug. *** 406804 2020-08-18 13:39:14 -0700 2020-08-18 13:39:14 -0700 Code Reproduction index.html text/html 715 ldebeasi PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0idmlld3Bv cnQtZml0PWNvdmVyLCB3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wLCBtaW5p bXVtLXNjYWxlPTEuMCwgbWF4aW11bS1zY2FsZT0xLjAsIHVzZXItc2NhbGFibGU9bm8iIC8+CiAg PC9oZWFkPgogIAogIDxib2R5PgogICAgPGhlbGxvLXdvcmxkPkNsaWNraW5nIG1lIHdpbGwgY2F1 c2UgYSBjcmFzaDwvaGVsbG8td29ybGQ+CiAgICAKICAgIDxiciAvPjxiciAvPgogICAgCiAgICA8 aGVsbG8td29ybGQ+Q2xpY2tpbmcgbWUgd2lsbCBOT1QgY2F1c2UgYSBjcmFzaCA8aW5wdXQgLz48 L2hlbGxvLXdvcmxkPgogICAgCiAgICA8c2NyaXB0PgogICAgICBjbGFzcyBIZWxsb1dvcmxkIGV4 dGVuZHMgSFRNTEVsZW1lbnQgewogICAgICAgIGNvbnN0cnVjdG9yKCkgewogICAgICAgICAgc3Vw ZXIoKTsKICAgICAgICAgIAogICAgICAgICAgdGhpcwogICAgICAgICAgICAuYXR0YWNoU2hhZG93 KHsgbW9kZTogJ29wZW4nLCBkZWxlZ2F0ZXNGb2N1czogdHJ1ZSB9KQogICAgICAgICAgICAuaW5u ZXJIVE1MID0gYDxzbG90Pjwvc2xvdD5gOyAgICAgICAKICAgICAgICB9CiAgICAgIH0KICAgICAg CiAgICAgIGN1c3RvbUVsZW1lbnRzLmRlZmluZSgnaGVsbG8td29ybGQnLCBIZWxsb1dvcmxkKTsK ICAgIDwvc2NyaXB0PgogIDwvYm9keT4KPC9odG1sPg== 406830 2020-08-18 23:56:28 -0700 2020-08-19 02:06:08 -0700 Fixes the crash bug-215622-20200818235628.patch text/plain 4020 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI2NTg0OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDIwLTA4LTE4ICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT04ocjI2NTA5Mik6 IGRlbGVnYXRlc0ZvY3VzIGNhdXNlcyBXZWJLaXQgdG8gY3Jhc2gKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxNTYyMgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBidWcgd2FzIGNhdXNlZCBieSBhIG1p c3NpbmcgbnVsbHB0ciBjaGVjay4gQWRkZWQgaXQuCisKKyAgICAgICAgVGVzdDogZmFzdC9zaGFk b3ctZG9tL2RlbGVnYXRlcy1mb2N1cy11bnN1Y2Nlc3NmdWxseS1ieS1hY3RpdmF0aW9uLmh0bWwK KworICAgICAgICAqIHBhZ2UvRXZlbnRIYW5kbGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkV2 ZW50SGFuZGxlcjo6ZGlzcGF0Y2hNb3VzZUV2ZW50KTogQWRkZWQgYSBudWxscHRyIGNoZWNrLgor CiAyMDIwLTA4LTE4ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAg QXVkaW9CdWZmZXIuZHVyYXRpb24gc2hvdWxkIHVzZSBkb3VibGUgcHJlY2lzaW9uCkluZGV4OiBT b3VyY2UvV2ViQ29yZS9wYWdlL0V2ZW50SGFuZGxlci5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNl L1dlYkNvcmUvcGFnZS9FdmVudEhhbmRsZXIuY3BwCShyZXZpc2lvbiAyNjU4NDMpCisrKyBTb3Vy Y2UvV2ViQ29yZS9wYWdlL0V2ZW50SGFuZGxlci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTI3NjEs NyArMjc2MSw3IEBAIGJvb2wgRXZlbnRIYW5kbGVyOjpkaXNwYXRjaE1vdXNlRXZlbnQoY28KICAg ICBpZiAocGFnZSAmJiAhcGFnZS0+Zm9jdXNDb250cm9sbGVyKCkuc2V0Rm9jdXNlZEVsZW1lbnQo ZWxlbWVudC5nZXQoKSwgbV9mcmFtZSkpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIAotICAgIGlm IChtX21vdXNlRG93bkRlbGVnYXRlZEZvY3VzKQorICAgIGlmIChlbGVtZW50ICYmIG1fbW91c2VE b3duRGVsZWdhdGVkRm9jdXMpCiAgICAgICAgIGVsZW1lbnQtPnJldmVhbEZvY3VzZWRFbGVtZW50 KFNlbGVjdGlvblJlc3RvcmF0aW9uTW9kZTo6U2V0RGVmYXVsdCk7CiAKICAgICByZXR1cm4gdHJ1 ZTsKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDI2NTg0MykKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwko d29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA4LTE4ICBSeW9zdWtlIE5pd2Eg IDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT04ocjI2NTA5Mik6IGRlbGVn YXRlc0ZvY3VzIGNhdXNlcyBXZWJLaXQgdG8gY3Jhc2gKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxNTYyMgorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZGVkIGEgcmVncmVzc2lvbiB0ZXN0LgorCisgICAg ICAgICogZmFzdC9zaGFkb3ctZG9tL2RlbGVnYXRlcy1mb2N1cy11bnN1Y2Nlc3NmdWxseS1ieS1h Y3RpdmF0aW9uLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9zaGFkb3ctZG9t L2RlbGVnYXRlcy1mb2N1cy11bnN1Y2Nlc3NmdWxseS1ieS1hY3RpdmF0aW9uLmh0bWw6IEFkZGVk LgorCiAyMDIwLTA4LTE4ICBBbmRyZXMgR29uemFsZXogIDxhbmRyZXNnXzIyQGFwcGxlLmNvbT4K IAogICAgICAgICBGaXggZm9yIGFjY2Vzc2liaWxpdHkvbWFjL2FyaWEtZXhwYW5kZWQtbm90aWZp Y2F0aW9ucy5odG1sIGluIGlzb2xhdGVkIHRyZWUgbW9kZS4KSW5kZXg6IExheW91dFRlc3RzL2Zh c3Qvc2hhZG93LWRvbS9kZWxlZ2F0ZXMtZm9jdXMtdW5zdWNjZXNzZnVsbHktYnktYWN0aXZhdGlv bi1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9zaGFkb3ctZG9t L2RlbGVnYXRlcy1mb2N1cy11bnN1Y2Nlc3NmdWxseS1ieS1hY3RpdmF0aW9uLWV4cGVjdGVkLnR4 dAkobm9uZXhpc3RlbnQpCisrKyBMYXlvdXRUZXN0cy9mYXN0L3NoYWRvdy1kb20vZGVsZWdhdGVz LWZvY3VzLXVuc3VjY2Vzc2Z1bGx5LWJ5LWFjdGl2YXRpb24tZXhwZWN0ZWQudHh0CSh3b3JraW5n IGNvcHkpCkBAIC0wLDAgKzEsMyBAQAorVGhpcyB0ZXN0cyBkZWxlZ2F0aW5nIGZvY3VzIGluIGEg c2hhZG93IHRyZWUgd2l0aG91dCBhIGZvY3VzYWJsZSBlbGVtZW50LiBXZWJLaXQgc2hvdWxkIG5v dCBjcmFzaC4KKworUEFTUyAtIFdlYktpdCBkaWQgbm90IGNyYXNoCkluZGV4OiBMYXlvdXRUZXN0 cy9mYXN0L3NoYWRvdy1kb20vZGVsZWdhdGVzLWZvY3VzLXVuc3VjY2Vzc2Z1bGx5LWJ5LWFjdGl2 YXRpb24uaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L3NoYWRvdy1kb20vZGVs ZWdhdGVzLWZvY3VzLXVuc3VjY2Vzc2Z1bGx5LWJ5LWFjdGl2YXRpb24uaHRtbAkobm9uZXhpc3Rl bnQpCisrKyBMYXlvdXRUZXN0cy9mYXN0L3NoYWRvdy1kb20vZGVsZWdhdGVzLWZvY3VzLXVuc3Vj Y2Vzc2Z1bGx5LWJ5LWFjdGl2YXRpb24uaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDM2 IEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGhlYWQ+Cis8bWV0YSBuYW1lPSJ2aWV3cG9y dCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEsIHVzZXItc2Nh bGFibGU9bm8iPgorPC9oZWFkPgorPGJvZHk+Cis8cD5UaGlzIHRlc3RzIGRlbGVnYXRpbmcgZm9j dXMgaW4gYSBzaGFkb3cgdHJlZSB3aXRob3V0IGEgZm9jdXNhYmxlIGVsZW1lbnQuIFdlYktpdCBz aG91bGQgbm90IGNyYXNoLjwvcD4KKzxzY3JpcHQgc3JjPSIuLi8uLi9yZXNvdXJjZXMvdWktaGVs cGVyLmpzIj48L3NjcmlwdD4KKzxzY3JpcHQ+CisKK2NvbnN0IGhvc3QgPSBkb2N1bWVudC5jcmVh dGVFbGVtZW50KCdkaXYnKTsKK2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoaG9zdCk7CisKK2Nv bnN0IHNoYWRvd1Jvb3QgPSBob3N0LmF0dGFjaFNoYWRvdyh7bW9kZTogJ2Nsb3NlZCcsIGRlbGVn YXRlc0ZvY3VzOiB0cnVlfSk7CitzaGFkb3dSb290LmlubmVySFRNTCA9IGBoZWxsb2A7Citob3N0 LmFkZEV2ZW50TGlzdGVuZXIoJ2NsaWNrJywgY29tcGxldGUpOworCithc3luYyBmdW5jdGlvbiBy dW5UZXN0KCkgeworICAgIGNvbnN0IGhvc3RSZWN0ID0gaG9zdC5nZXRCb3VuZGluZ0NsaWVudFJl Y3QoKTsKKyAgICBhd2FpdCBVSUhlbHBlci5hY3RpdmF0ZUF0KGhvc3RSZWN0LnggKyA1LCBob3N0 UmVjdC55ICsgNSk7CisgICAgYXdhaXQgVUlIZWxwZXIuZW5zdXJlUHJlc2VudGF0aW9uVXBkYXRl KCk7CisgICAgYXdhaXQgbmV3IFByb21pc2UocmVxdWVzdEFuaW1hdGlvbkZyYW1lKTsKK30KKwor ZnVuY3Rpb24gY29tcGxldGUoKSB7CisgICAgaG9zdC5vdXRlckhUTUwgPSAnUEFTUyAtIFdlYktp dCBkaWQgbm90IGNyYXNoJzsKK30KKworaWYgKHdpbmRvdy50ZXN0UnVubmVyKSB7CisgICAgdGVz dFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgICAgVUlIZWxwZXIud2FpdChydW5UZXN0KCkpOworfQor Cis8L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K 407108 2020-08-24 10:07:40 -0700 2020-08-24 10:07:40 -0700 Crash with focusable button stpcrash-with-button.html text/html 804 lizmitchell PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0idmlld3Bv cnQtZml0PWNvdmVyLCB3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wLCBtaW5p bXVtLXNjYWxlPTEuMCwgbWF4aW11bS1zY2FsZT0xLjAsIHVzZXItc2NhbGFibGU9bm8iIC8+CiAg PC9oZWFkPgoKICA8Ym9keT4KICAgIDxoZWxsby13b3JsZD5DbGlja2luZyBtZSB3aWxsIGNhdXNl IGEgY3Jhc2g8L2hlbGxvLXdvcmxkPgoKICAgIDxiciAvPjxiciAvPgoKICAgIDxoZWxsby13b3Js ZD5DbGlja2luZyBtZSBTSE9VTEQgTk9UIGNyYXNoIChidXQgZG9lcyBvbiBTVFAgMTEyKSA8YnV0 dG9uPkJ1dHRvbjwvYnV0dG9uPjwvaGVsbG8td29ybGQ+CgogICAgPGJyIC8+PGJyIC8+CgogICAg PGhlbGxvLXdvcmxkPkNsaWNraW5nIG1lIFdJTEwgTk9UIGNhdXNlIGEgY3Jhc2ggPGlucHV0IC8+ PC9oZWxsby13b3JsZD4KCiAgICA8c2NyaXB0PgogICAgICBjbGFzcyBIZWxsb1dvcmxkIGV4dGVu ZHMgSFRNTEVsZW1lbnQgewogICAgICAgIGNvbnN0cnVjdG9yKCkgewogICAgICAgICAgc3VwZXIo KTsKCiAgICAgICAgICB0aGlzCiAgICAgICAgICAgIC5hdHRhY2hTaGFkb3coeyBtb2RlOiAnb3Bl bicsIGRlbGVnYXRlc0ZvY3VzOiB0cnVlIH0pCiAgICAgICAgICAgIC5pbm5lckhUTUwgPSBgPHNs b3Q+PC9zbG90PmA7CiAgICAgICAgfQogICAgICB9CgogICAgICBjdXN0b21FbGVtZW50cy5kZWZp bmUoJ2hlbGxvLXdvcmxkJywgSGVsbG9Xb3JsZCk7CiAgICA8L3NjcmlwdD4KICA8L2JvZHk+Cjwv aHRtbD4K