<rdar://problem/7563219> Null dereference when dragging an element with generated...
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 Oct 2010 19:16:25 +0000 (19:16 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 Oct 2010 19:16:25 +0000 (19:16 +0000)
https://bugs.webkit.org/show_bug.cgi?id=47005

Reviewed by Adele Peterson.

WebCore:

Test: fast/css-generated-content/drag-state.html

* rendering/RenderObject.cpp:
(WebCore::RenderObject::updateDragState): Null-check node().

LayoutTests:

* fast/css-generated-content/drag-state-expected.txt: Added.
* fast/css-generated-content/drag-state.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@68911 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css-generated-content/drag-state-expected.txt [new file with mode: 0644]
LayoutTests/fast/css-generated-content/drag-state.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/RenderObject.cpp

index 36d4227..8e1d036 100644 (file)
@@ -1,3 +1,13 @@
+2010-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7563219> Null dereference when dragging an element with generated content
+        https://bugs.webkit.org/show_bug.cgi?id=47005
+
+        * fast/css-generated-content/drag-state-expected.txt: Added.
+        * fast/css-generated-content/drag-state.html: Added.
+
 2010-10-01  Alpha Lam  <hclam@chromium.org>
 
         Not reviewed. Build fix.
diff --git a/LayoutTests/fast/css-generated-content/drag-state-expected.txt b/LayoutTests/fast/css-generated-content/drag-state-expected.txt
new file mode 100644 (file)
index 0000000..0e31fe9
--- /dev/null
@@ -0,0 +1,3 @@
+Test for https://bugs.webkit.org/show_bug.cgi?id=47005 Null dereference when dragging an element with generated content.
+
+Drag the box above. The text should become blue and the browser should not crash.
diff --git a/LayoutTests/fast/css-generated-content/drag-state.html b/LayoutTests/fast/css-generated-content/drag-state.html
new file mode 100644 (file)
index 0000000..5bf27c3
--- /dev/null
@@ -0,0 +1,22 @@
+<style>
+    #target { border: solid; -webkit-user-drag: element; width: 100px; height: 100px; }
+    #target:before { content: "Drag this"; }
+    #target:-webkit-drag:before { color: blue; }
+</style>
+<div id="target"></div>
+<p>
+    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=47005">https://bugs.webkit.org/show_bug.cgi?id=47005</a>
+    Null dereference when dragging an element with generated content</i>.
+</p>
+<p>
+    Drag the box above. The text should become blue and the browser should not crash.
+</p>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        eventSender.mouseMoveTo(50, 50);
+        eventSender.mouseDown();
+        eventSender.mouseMoveTo(250, 250);
+        eventSender.mouseUp();
+    }
+</script>
index f20294e..41e3784 100644 (file)
@@ -1,3 +1,15 @@
+2010-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7563219> Null dereference when dragging an element with generated content
+        https://bugs.webkit.org/show_bug.cgi?id=47005
+
+        Test: fast/css-generated-content/drag-state.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateDragState): Null-check node().
+
 2010-10-01  Robert Hogan  <robert@webkit.org>
 
         Reviewed by Adam Barth.
index 9e86dd8..8be614d 100644 (file)
@@ -2224,7 +2224,7 @@ void RenderObject::updateDragState(bool dragOn)
 {
     bool valueChanged = (dragOn != m_isDragging);
     m_isDragging = dragOn;
-    if (valueChanged && style()->affectedByDragRules())
+    if (valueChanged && style()->affectedByDragRules() && node())
         node()->setNeedsStyleRecalc();
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling())
         curr->updateDragState(dragOn);