Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 63d08dbe5305b4f63a3d7aad95bb207dd59b8ee6
https://github.com/WebKit/WebKit/commit/63d08dbe5305b4f63a3d7aad95bb207dd59b8ee6
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-25 (Sat, 25 Jul 2026)
Changed paths:
M Source/WebCore/editing/mac/TextAlternativeWithRange.mm
M Source/WebCore/editing/mac/TextUndoInsertionMarkupMac.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/WKWebViewMacEditingTests.mm
Log Message:
-----------
Potential crash under WebViewImpl::insertText() with a zero-length attributed
string
https://bugs.webkit.org/show_bug.cgi?id=320263
rdar://183187277
Reviewed by Wenson Hsieh.
collectDictationTextAlternatives() and shouldRegisterInsertionUndoGroup()
both unconditionally read attributes at index 0 of the NSAttributedString
passed to WebViewImpl::insertText(id, NSRange), without checking the
string's length first. An empty NSMutableAttributedString raises
NSRangeException for such an access, so passing a zero-length attributed
string (e.g. from an input method committing a composition down to nothing,
or from the Character Viewer) crashed. Guard both functions with a length
check.
Note that an empty immutable NSAttributedString happens not to raise, so
the new tests use NSMutableAttributedString to exercise the crashing path.
The equivalent WebHTMLView insertText: path in WebKitLegacy has a third
unguarded index-0 read of NSTextInputReplacementRangeAttributeName that
this change does not address.
* Source/WebCore/editing/mac/TextAlternativeWithRange.mm:
(WebCore::collectDictationTextAlternatives):
* Source/WebCore/editing/mac/TextUndoInsertionMarkupMac.mm:
(WebCore::shouldRegisterInsertionUndoGroup):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/WKWebViewMacEditingTests.mm:
(TestWebKitAPI::TEST(WKWebViewMacEditingTests,
InsertEmptyAttributedStringDoesNotCrash)):
(TestWebKitAPI::TEST(WKWebViewMacEditingTests,
InsertEmptyAttributedStringWithAttributesDoesNotCrash)):
Canonical link: https://commits.webkit.org/317932@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
