Commit d8c933c
committed
[ASDisplayNode] Fix a crash in insertSubnode
If a node is already a subnode to a supernode, Inserting it again can lead to a crash.
Here is a simple repro of the crash:
```
ASDisplayNode *subnode = [[ASDisplayNode alloc] init];
ASDisplayNode *supernode = [[ASDisplayNode alloc] init];
[supernode addSubnode:subnode];
// Crash on next line
[supernode insertSubnode:subnode atIndex:1];
```
The issue is that all the checks around subnode array boundaries are done BEFORE `subnode` is removed from its `supernode`. If it happens that the `supernode` is self, then removing the `subnode` causes all our index checks to no longer be valid.
Here is the relevant code:
```
__instanceLock__.lock();
NSUInteger subnodesCount = _subnodes.count;
__instanceLock__.unlock();
////// Here we check our indexes
if (subnodeIndex > subnodesCount || subnodeIndex < 0) {
ASDisplayNodeFailAssert(@"Cannot insert a subnode at index %ld. Count is %ld", (long)subnodeIndex, (long)subnodesCount);
return;
}
…
///////// Here our indexes could invalidate if self subnode’s supernode
[subnode removeFromSupernode];
[oldSubnode removeFromSupernode];
__instanceLock__.lock();
if (_subnodes == nil) {
_subnodes = [[NSMutableArray alloc] init];
}
////// Here would can crash if our index is too big
[_subnodes insertObject:subnode atIndex:subnodeIndex];
_cachedSubnodes = nil;
__instanceLock__.unlock();
```1 parent 83c6ff8 commit d8c933c
2 files changed
+16
-0
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2104 | 2104 | | |
2105 | 2105 | | |
2106 | 2106 | | |
| 2107 | + | |
| 2108 | + | |
| 2109 | + | |
| 2110 | + | |
| 2111 | + | |
2107 | 2112 | | |
2108 | 2113 | | |
2109 | 2114 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2783 | 2783 | | |
2784 | 2784 | | |
2785 | 2785 | | |
| 2786 | + | |
| 2787 | + | |
| 2788 | + | |
| 2789 | + | |
| 2790 | + | |
| 2791 | + | |
| 2792 | + | |
| 2793 | + | |
| 2794 | + | |
| 2795 | + | |
| 2796 | + | |
2786 | 2797 | | |
0 commit comments