git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 484648a)
WebCore:
authoradele@apple.com <adele@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 16 Nov 2007 07:00:50 +0000 (07:00 +0000)
committeradele@apple.com <adele@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 16 Nov 2007 07:00:50 +0000 (07:00 +0000)
        Reviewed by Oliver.

        Fix for <rdar://problem/5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)

        Test: fast/forms/menulist-no-renderer-onmousedown.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::defaultEventHandler): Nil check the renderer here.  None of the default behavior makes sense if there's no renderer.
        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Moved the nil check to the main defaultEventHandler.

LayoutTests:

        Reviewed by Oliver.

        Test for <rdar://problem/5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)

        * fast/forms/menulist-no-renderer-onmousedown-expected.txt: Added.
        * fast/forms/menulist-no-renderer-onmousedown.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27843 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/forms/menulist-no-renderer-onmousedown-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/forms/menulist-no-renderer-onmousedown.html [new file with mode: 0644] patch | blob
WebCore/ChangeLog patch | blob | history
WebCore/html/HTMLSelectElement.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 0779214875c7bcd630a848dffad8744ad490fd1e..bc91248225839ebd548174d1f5e3736a9f2bd0c6 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2007-11-15  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver.
+
+        Test for <rdar://problem/5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)
+
+        * fast/forms/menulist-no-renderer-onmousedown-expected.txt: Added.
+        * fast/forms/menulist-no-renderer-onmousedown.html: Added.
+
 2007-11-15  Khoo Yit Phang  <khooyp@cs.umd.edu>
 
         Reviewed by Darin.
diff --git a/LayoutTests/fast/forms/menulist-no-renderer-onmousedown-expected.txt b/LayoutTests/fast/forms/menulist-no-renderer-onmousedown-expected.txt
new file mode 100644 (file)
index 0000000..88ad08f
--- /dev/null
+++ b/LayoutTests/fast/forms/menulist-no-renderer-onmousedown-expected.txt
@@ -0,0 +1,2 @@
+This tests that we don't crash if a menu list's renderer is destroyed during the mouse down event. 
+
diff --git a/LayoutTests/fast/forms/menulist-no-renderer-onmousedown.html b/LayoutTests/fast/forms/menulist-no-renderer-onmousedown.html
new file mode 100644 (file)
index 0000000..2d1c090
--- /dev/null
+++ b/LayoutTests/fast/forms/menulist-no-renderer-onmousedown.html
@@ -0,0 +1,20 @@
+<html>
+    <head>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+                var sl = document.getElementById('sl');
+                var event = document.createEvent("MouseEvent");
+                event.initMouseEvent("mousedown", true, true, window, 1, sl.offsetLeft, sl.offsetTop, sl.offsetLeft, sl.offsetTop, false, false, false, false, 0, document);
+                sl.dispatchEvent(event);
+            }
+        </script>
+    </head>
+    <body onload="test()">
+        This tests that we don't crash if a menu list's renderer is destroyed during the mouse down event.
+        <br>
+        <select id="sl" onmousedown="this.style.display='none'"><option>test</select>
+    </body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8d0c9c607243688052b49a6c8de46b25042e441d..530f9f5621af2159e6b5b0482d1c639d0efe147f 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2007-11-15  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver.
+
+        Fix for <rdar://problem/5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)
+
+        Test: fast/forms/menulist-no-renderer-onmousedown.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::defaultEventHandler): Nil check the renderer here.  None of the default behavior makes sense if there's no renderer.
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Moved the nil check to the main defaultEventHandler.
+
 2007-11-15  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Adele.
diff --git a/WebCore/html/HTMLSelectElement.cpp b/WebCore/html/HTMLSelectElement.cpp
index d0c045c8e1d5f14dd239015cd13373d7dd1d5c75..44332e993159944939f9c9415a9d284148414cf4 100644 (file)
--- a/WebCore/html/HTMLSelectElement.cpp
+++ b/WebCore/html/HTMLSelectElement.cpp
@@ -592,6 +592,9 @@ void HTMLSelectElement::dispatchBlurEvent()
 
 void HTMLSelectElement::defaultEventHandler(Event* evt)
 {
+    if (!renderer())
+        return;
+    
     if (usesMenuList())
         menuListDefaultEventHandler(evt);
     else 
@@ -686,9 +689,6 @@ void HTMLSelectElement::menuListDefaultEventHandler(Event* evt)
 
 void HTMLSelectElement::listBoxDefaultEventHandler(Event* evt)
 {
-    if (!renderer())
-        return;
-
     if (evt->type() == mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
         focus();
         
Mirror of the WebKit open source project from svn.webkit.org.