git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (from parent 1: 6afacd5)
Search events should not fire synchronously for search type input elements with incre...
authorjiewen_tan@apple.com <jiewen_tan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 8 May 2017 19:17:29 +0000 (19:17 +0000)
committerjiewen_tan@apple.com <jiewen_tan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 8 May 2017 19:17:29 +0000 (19:17 +0000)
https://bugs.webkit.org/show_bug.cgi?id=171376
<rdar://problem/31863296>

Reviewed by Chris Dumez.

Source/WebCore:

For some reasons, we fire search events immediately for search type input elements with incremental
attribute set only when the length of the input equals to zero. This behaviour should be prevented
as event listeners in the middle might perform unexpectedly.

Test: fast/forms/search/search-incremental-crash.html

* html/SearchInputType.cpp:
(WebCore::SearchInputType::startSearchEventTimer):

LayoutTests:

* fast/forms/search/search-incremental-crash-expected.txt: Added.
* fast/forms/search/search-incremental-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@216443 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/forms/search/search-incremental-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/forms/search/search-incremental-crash.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/html/SearchInputType.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 0887c62..59395e5 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2017-05-04  Jiewen Tan  <jiewen_tan@apple.com>
+
+        Search events should not fire synchronously for search type input elements with incremental attribute set
+        https://bugs.webkit.org/show_bug.cgi?id=171376
+        <rdar://problem/31863296>
+
+        Reviewed by Chris Dumez.
+
+        * fast/forms/search/search-incremental-crash-expected.txt: Added.
+        * fast/forms/search/search-incremental-crash.html: Added.
+
 2017-05-08  Zalan Bujtas  <zalan@apple.com>
 
         Text overlaps on http://www.duden.de/rechtschreibung/Acre
diff --git a/LayoutTests/fast/forms/search/search-incremental-crash-expected.txt b/LayoutTests/fast/forms/search/search-incremental-crash-expected.txt
new file mode 100644 (file)
index 0000000..2b7c6fe
--- /dev/null
+++ b/LayoutTests/fast/forms/search/search-incremental-crash-expected.txt
@@ -0,0 +1 @@
+ Test passes if WebKit doesn't crash.
diff --git a/LayoutTests/fast/forms/search/search-incremental-crash.html b/LayoutTests/fast/forms/search/search-incremental-crash.html
new file mode 100644 (file)
index 0000000..933b33b
--- /dev/null
+++ b/LayoutTests/fast/forms/search/search-incremental-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    var runcount = 0;
+    function go() {
+        runcount++;
+        if (runcount > 2)
+            return;
+
+        i.type = "foo";
+        i.select();
+        i.type = "search";
+
+        document.onsearch = document.body.onload;
+
+        document.execCommand("insertHTML", false, "");
+    }
+</script>
+</head>
+<body onload=go()>
+<input id="i" type="checkbox" incremental="incremental">
+Test passes if WebKit doesn't crash.
+</body>
+</html>
\ No newline at end of file
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 95e710d..992cab7 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2017-05-04  Jiewen Tan  <jiewen_tan@apple.com>
+
+        Search events should not fire synchronously for search type input elements with incremental attribute set
+        https://bugs.webkit.org/show_bug.cgi?id=171376
+        <rdar://problem/31863296>
+
+        Reviewed by Chris Dumez.
+
+        For some reasons, we fire search events immediately for search type input elements with incremental
+        attribute set only when the length of the input equals to zero. This behaviour should be prevented
+        as event listeners in the middle might perform unexpectedly.
+
+        Test: fast/forms/search/search-incremental-crash.html
+
+        * html/SearchInputType.cpp:
+        (WebCore::SearchInputType::startSearchEventTimer):
+
 2017-05-08  Zalan Bujtas  <zalan@apple.com>
 
         Text overlaps on http://www.duden.de/rechtschreibung/Acre
diff --git a/Source/WebCore/html/SearchInputType.cpp b/Source/WebCore/html/SearchInputType.cpp
index 6bbf8be..a2a6f8a 100644 (file)
--- a/Source/WebCore/html/SearchInputType.cpp
+++ b/Source/WebCore/html/SearchInputType.cpp
@@ -161,8 +161,7 @@ void SearchInputType::startSearchEventTimer()
     unsigned length = element().innerTextValue().length();
 
     if (!length) {
-        stopSearchEventTimer();
-        element().onSearch();
+        m_searchEventTimer.startOneShot(0_ms);
         return;
     }
 
Mirror of the WebKit open source project from svn.webkit.org.