git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: a080383)
Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
authorddkilzer@apple.com <ddkilzer@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 25 Mar 2014 16:42:15 +0000 (16:42 +0000)
committerddkilzer@apple.com <ddkilzer@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 25 Mar 2014 16:42:15 +0000 (16:42 +0000)
<http://webkit.org/b/130713>
<rdar://problem/15661876>

Reviewed by Darin Adler.

Merged from Blink (patch by Ian Beer):
http://crbug.com/303657
https://src.chromium.org/viewvc/blink?view=rev&revision=158938

Source/WebCore:

Test: fast/forms/form-submission-crash-successful-submit-button.html

* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::submit):

LayoutTests:

* fast/forms/form-submission-crash-successful-submit-button-expected.txt: Added.
* fast/forms/form-submission-crash-successful-submit-button.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@166236 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/forms/form-submission-crash-successful-submit-button-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/forms/form-submission-crash-successful-submit-button.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/html/HTMLFormElement.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index d488916b5730fc276e416abbb29270c49c9dbb63..8c58347ff8239fba4f23820c374238d9de2025cd 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2014-03-25  David Kilzer  <ddkilzer@apple.com>
+
+        Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
+        <http://webkit.org/b/130713>
+        <rdar://problem/15661876>
+
+        Reviewed by Darin Adler.
+
+        Merged from Blink (patch by Ian Beer):
+        http://crbug.com/303657
+        https://src.chromium.org/viewvc/blink?view=rev&revision=158938
+
+        * fast/forms/form-submission-crash-successful-submit-button-expected.txt: Added.
+        * fast/forms/form-submission-crash-successful-submit-button.html: Added.
+
 2014-03-20  Sergio Villar Senin  <svillar@igalia.com>
 
         [CSS Grid Layout] Vertical rectangles not considered as valid grid areas
diff --git a/LayoutTests/fast/forms/form-submission-crash-successful-submit-button-expected.txt b/LayoutTests/fast/forms/form-submission-crash-successful-submit-button-expected.txt
new file mode 100644 (file)
index 0000000..93ab568
--- /dev/null
+++ b/LayoutTests/fast/forms/form-submission-crash-successful-submit-button-expected.txt
@@ -0,0 +1,5 @@
+PASS if not crashed.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/form-submission-crash-successful-submit-button.html b/LayoutTests/fast/forms/form-submission-crash-successful-submit-button.html
new file mode 100644 (file)
index 0000000..0040479
--- /dev/null
+++ b/LayoutTests/fast/forms/form-submission-crash-successful-submit-button.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<body>
+<script src="../../resources/js-test-pre.js"></script>
+<script>
+jsTestIsAsync = true;
+var form1;
+var submit1;
+
+function start() {
+    form1 = document.createElement('form');
+    submit1 = document.createElement('input');
+    submit2 = document.createElement('input');
+    submit1.type = 'submit';
+    submit2.type = 'image';
+    form1.addEventListener('submit', handleSubmit, false);
+    form1.action = 'javascript:removeImage()';
+    form1.appendChild(submit1);
+    form1.appendChild(submit2);
+    submit1.click();
+    testPassed('if not crashed.');
+    finishJSTest();
+}
+
+function handleSubmit() {
+    form1.removeChild(submit1);
+}
+
+function removeImage() {
+    form1.removeChild(submit2);
+    submit2 = null;
+    gc();
+}
+
+window.onload = start;
+</script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 84882999754f669480651464cbb800ed169beff9..c4696a66c0f9a8af9ecc134a98e8334ef8e65058 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2014-03-25  David Kilzer  <ddkilzer@apple.com>
+
+        Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
+        <http://webkit.org/b/130713>
+        <rdar://problem/15661876>
+
+        Reviewed by Darin Adler.
+
+        Merged from Blink (patch by Ian Beer):
+        http://crbug.com/303657
+        https://src.chromium.org/viewvc/blink?view=rev&revision=158938
+
+        Test: fast/forms/form-submission-crash-successful-submit-button.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit):
+
 2014-03-25  Gabor Rapcsanyi  <rgabor@webkit.org>
 
         [ARM64] GNU assembler fails in TransformationMatrix::multiply
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 60a138796f5cf3d02948edd77128403dc82933fc..6a7149ea5e6e0a8c5f58dea8962075f7f2f328a3 100644 (file)
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -333,7 +333,7 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool proce
     m_isSubmittingOrPreparingForSubmission = true;
     m_wasUserSubmitted = processingUserGesture;
 
-    HTMLFormControlElement* firstSuccessfulSubmitButton = 0;
+    RefPtr<HTMLFormControlElement> firstSuccessfulSubmitButton;
     bool needButtonActivation = activateSubmitButton; // do we need to activate a submit button?
 
     for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
Mirror of the WebKit open source project from svn.webkit.org.