[Datalist] Crash when input with datalist is dynamically added.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 9 Jan 2019 22:25:41 +0000 (22:25 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 9 Jan 2019 22:25:41 +0000 (22:25 +0000)
commit4bbcb5c3cf3d87c10d48b64a877db592a24a21a2
treee1913b5b3bd6d80f468d230287d14f486d96486f
parentf546782bd385a41ed4ee34c2051b89f4a39faf69
[Datalist] Crash when input with datalist is dynamically added.
https://bugs.webkit.org/show_bug.cgi?id=193012
<rdar://problem/45923457>

Reviewed by Brent Fulgham.

Source/WebCore:

In certain cases (cloning, setAttribute), it's too early to check for the list attribute in createShadowSubtree
to see whether the input needs datalist related items. The list attribute is simply not set yet.
This patch only addresses the obvious crash. m_dataListDropdownIndicator clearly lacks proper lifecycle management (see webkit.org/b/193032).

Test: fast/forms/datalist/datalist-crash-when-dynamic.html

* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::createShadowSubtree):
(WebCore::TextFieldInputType::attributeChanged):
(WebCore::TextFieldInputType::createDataListDropdownIndicator):
* html/TextFieldInputType.h:

LayoutTests:

* fast/forms/datalist/datalist-crash-when-dynamic-expected.txt: Added.
* fast/forms/datalist/datalist-crash-when-dynamic.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239786 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/forms/datalist/datalist-crash-when-dynamic-expected.txt [new file with mode: 0644]
LayoutTests/fast/forms/datalist/datalist-crash-when-dynamic.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/TextFieldInputType.cpp
Source/WebCore/html/TextFieldInputType.h
Source/WebCore/rendering/RenderThemeMac.mm