Crash when replacing parts of text inputs with content: url(...)
authortasak@google.com <tasak@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Nov 2012 08:23:48 +0000 (08:23 +0000)
committertasak@google.com <tasak@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Nov 2012 08:23:48 +0000 (08:23 +0000)
commit68a74b88f95a0bdfb3ca65587e520b6e329921a3
treed0cd6db4dc2246fc64f16c14fa76e705f75ee3a1
parentcb407c30b77382212881fa0d8500ebe16d675c90
Crash when replacing parts of text inputs with content: url(...)
https://bugs.webkit.org/show_bug.cgi?id=101133

Reviewed by Kent Tamura.

Source/WebCore:

Disable directly setting content of elements in an input element's
shadow dom tree, because the setting breaks input element's behavior.

Tests: fast/forms/number/number-content-url-crash.html
       fast/forms/search/search-content-url-crash.html

* css/html.css:
(input::-webkit-textfield-decoration-container):
Use important to disable overriding an input element's content
property.
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::attach):
Added ASSERTION. No content should be applied to
input::-webkit-textfield-decoration-container.

LayoutTests:

* fast/forms/number/number-content-url-crash-expected.txt: Added.
* fast/forms/number/number-content-url-crash.html: Added.
* fast/forms/search/search-content-url-crash-expected.txt: Added.
* fast/forms/search/search-content-url-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@134377 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/forms/number/number-content-url-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/forms/number/number-content-url-crash.html [new file with mode: 0644]
LayoutTests/fast/forms/search/search-content-url-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/forms/search/search-content-url-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/html.css
Source/WebCore/html/TextFieldInputType.cpp