SearchInputType could end up with a mismatched renderer.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 3 May 2017 23:57:18 +0000 (23:57 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 3 May 2017 23:57:18 +0000 (23:57 +0000)
https://bugs.webkit.org/show_bug.cgi?id=171547
<rdar://problem/31935047>

Reviewed by Antti Koivisto.

Source/WebCore:

Normally we've got the correct renderer by the time we call into SearchInputType.
However, since HTMLInputElement::updateType() eagerly updates the type while the associated renderers are done lazily
(so we don't get them updated until after the next tree update), we could actually end up
with a mismatched renderer (e.g. through form submission).

Test: fast/forms/change-input-type-and-submit-form-crash.html

* html/SearchInputType.cpp:
(WebCore::SearchInputType::addSearchResult):
(WebCore::SearchInputType::didSetValueByUserEdit):

LayoutTests:

* fast/forms/change-input-type-and-submit-form-crash-expected.txt: Added.
* fast/forms/change-input-type-and-submit-form-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@216159 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/forms/change-input-type-and-submit-form-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/forms/change-input-type-and-submit-form-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/SearchInputType.cpp

index 7059ebf..8859c74 100644 (file)
@@ -1,3 +1,14 @@
+2017-05-03  Zalan Bujtas  <zalan@apple.com>
+
+        SearchInputType could end up with a mismatched renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=171547
+        <rdar://problem/31935047>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/forms/change-input-type-and-submit-form-crash-expected.txt: Added.
+        * fast/forms/change-input-type-and-submit-form-crash.html: Added.
+
 2017-05-03  Ryan Haddad  <ryanhaddad@apple.com>
 
         Mark media/modern-media-controls/slider/slider-styles.html as flaky on mac-wk1.
diff --git a/LayoutTests/fast/forms/change-input-type-and-submit-form-crash-expected.txt b/LayoutTests/fast/forms/change-input-type-and-submit-form-crash-expected.txt
new file mode 100644 (file)
index 0000000..3cd69de
--- /dev/null
@@ -0,0 +1,2 @@
+PASS if no crash or assert.
+
diff --git a/LayoutTests/fast/forms/change-input-type-and-submit-form-crash.html b/LayoutTests/fast/forms/change-input-type-and-submit-form-crash.html
new file mode 100644 (file)
index 0000000..7d50ab4
--- /dev/null
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that submitting a form soon after changing the input type is ok.</title>
+</head>
+<body>
+PASS if no crash or assert.
+<form id=formToSubmit><input id=inputToChange results="1"></form>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+document.body.offsetHeight;
+inputToChange.value = "1";
+inputToChange.type = "search";
+formToSubmit.submit();
+</script>
+<body>
+</html>
index 0296c5e..10366fc 100644 (file)
@@ -1,3 +1,22 @@
+2017-05-03  Zalan Bujtas  <zalan@apple.com>
+
+        SearchInputType could end up with a mismatched renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=171547
+        <rdar://problem/31935047>
+
+        Reviewed by Antti Koivisto.
+
+        Normally we've got the correct renderer by the time we call into SearchInputType.
+        However, since HTMLInputElement::updateType() eagerly updates the type while the associated renderers are done lazily
+        (so we don't get them updated until after the next tree update), we could actually end up
+        with a mismatched renderer (e.g. through form submission).
+
+        Test: fast/forms/change-input-type-and-submit-form-crash.html
+
+        * html/SearchInputType.cpp:
+        (WebCore::SearchInputType::addSearchResult):
+        (WebCore::SearchInputType::didSetValueByUserEdit):
+
 2017-05-03  Jer Noble  <jer.noble@apple.com>
 
         Make the VPIO audio unit a singleton, shared between multiple CaptureSources
index d82359f..6bbf8be 100644 (file)
@@ -55,8 +55,11 @@ SearchInputType::SearchInputType(HTMLInputElement& element)
 void SearchInputType::addSearchResult()
 {
 #if !PLATFORM(IOS)
-    if (auto* renderer = element().renderer())
-        downcast<RenderSearchField>(*renderer).addSearchResult();
+    // Normally we've got the correct renderer by the time we get here. However when the input type changes
+    // we don't update the associated renderers until after the next tree update, so we could actually end up here
+    // with a mismatched renderer (e.g. through form submission).
+    if (is<RenderSearchField>(element().renderer()))
+        downcast<RenderSearchField>(*element().renderer()).addSearchResult();
 #endif
 }
 
@@ -185,9 +188,8 @@ bool SearchInputType::searchEventsShouldBeDispatched() const
 
 void SearchInputType::didSetValueByUserEdit()
 {
-    if (m_cancelButton && element().renderer())
+    if (m_cancelButton && is<RenderSearchField>(element().renderer()))
         downcast<RenderSearchField>(*element().renderer()).updateCancelButtonVisibility();
-
     // If the incremental attribute is set, then dispatch the search event
     if (searchEventsShouldBeDispatched())
         startSearchEventTimer();