Reviewed by Alice.
authoradele <adele@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 13 Oct 2006 01:39:14 +0000 (01:39 +0000)
committeradele <adele@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 13 Oct 2006 01:39:14 +0000 (01:39 +0000)
        - Fix for <rdar://problem/4707372>
          After timers fix, crash in -[NSMenu performActionForItemAtIndex:] after moving/detroying active popup menu

        * platform/PopupMenu.h: (WebCore::PopupMenu::menuListIsDetaching): Added. Zeros out the pointer to the menu list.
        * rendering/RenderMenuList.cpp: (WebCore::RenderMenuList::~RenderMenuList): Calls menuListIsDetaching.
        * platform/mac/PopupMenuMac.mm: (WebCore::PopupMenu::show): Added a RefPtr to protect the PopupMenu while the NSMenu is up,
          in case the RenderMenuList goes away.  Also, checks the pointer to the menu list immediately afterwards.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17022 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore/ChangeLog
WebCore/platform/PopupMenu.h
WebCore/platform/mac/PopupMenuMac.mm
WebCore/rendering/RenderMenuList.cpp

index 95815c9..fc702b2 100644 (file)
@@ -1,3 +1,15 @@
+2006-10-12  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Alice.
+
+        - Fix for <rdar://problem/4707372> 
+          After timers fix, crash in -[NSMenu performActionForItemAtIndex:] after moving/detroying active popup menu
+
+        * platform/PopupMenu.h: (WebCore::PopupMenu::menuListIsDetaching): Added. Zeros out the pointer to the menu list.
+        * rendering/RenderMenuList.cpp: (WebCore::RenderMenuList::~RenderMenuList): Calls menuListIsDetaching.
+        * platform/mac/PopupMenuMac.mm: (WebCore::PopupMenu::show): Added a RefPtr to protect the PopupMenu while the NSMenu is up,
+          in case the RenderMenuList goes away.  Also, checks the pointer to the menu list immediately afterwards.
+
 2006-10-12  Nikolas Zimmermann  <zimmermann@kde.org>
 
         Reviewed by Maciej.
index 2f58223..fde0de2 100644 (file)
@@ -47,6 +47,8 @@ public:
     static PassRefPtr<PopupMenu> create(RenderMenuList* menuList);
     ~PopupMenu();
     
+    void menuListIsDetaching() { m_menuList = 0; }
+
     void clear();
     void populate();
     void show(const IntRect&, FrameView*, int index);
index 9ea4e9a..f48c14a 100644 (file)
@@ -99,17 +99,21 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     // state after the NSMenu goes away.
     RefPtr<FrameMac> frame = Mac(v->frame());
     NSEvent* event = [frame->currentEvent() retain];
-
+    
+    RefPtr<PopupMenu> protector(this);
     wkPopupMenu(menu, location, roundf(NSWidth(r)), view, index, font);
-    int newIndex = [popup indexOfSelectedItem];
-    menuList()->hidePopup();
 
-    if (index != newIndex && newIndex >= 0)
-        menuList()->valueChanged(newIndex);
+    if (menuList()) {
+        int newIndex = [popup indexOfSelectedItem];
+        menuList()->hidePopup();
 
-    // Give the frame a chance to fix up its event state, since the popup eats all the
-    // events during tracking.
-    frame->sendFakeEventsAfterWidgetTracking(event);
+        if (index != newIndex && newIndex >= 0)
+            menuList()->valueChanged(newIndex);
+
+        // Give the frame a chance to fix up its event state, since the popup eats all the
+        // events during tracking.
+        frame->sendFakeEventsAfterWidgetTracking(event);
+    }
 
     [event release];
 }
index 165fa70..83df75f 100644 (file)
@@ -54,6 +54,8 @@ RenderMenuList::RenderMenuList(HTMLSelectElement* element)
 
 RenderMenuList::~RenderMenuList()
 {
+    if (m_popup)
+        m_popup->menuListIsDetaching();
     m_popup = 0;
 }