Reviewed by Oliver.
Fix for <rdar://problem/
5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)
Test: fast/forms/menulist-no-renderer-onmousedown.html
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::defaultEventHandler): Nil check the renderer here. None of the default behavior makes sense if there's no renderer.
(WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Moved the nil check to the main defaultEventHandler.
LayoutTests:
Reviewed by Oliver.
Test for <rdar://problem/
5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)
* fast/forms/menulist-no-renderer-onmousedown-expected.txt: Added.
* fast/forms/menulist-no-renderer-onmousedown.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27843
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2007-11-15 Adele Peterson <adele@apple.com>
+
+ Reviewed by Oliver.
+
+ Test for <rdar://problem/5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)
+
+ * fast/forms/menulist-no-renderer-onmousedown-expected.txt: Added.
+ * fast/forms/menulist-no-renderer-onmousedown.html: Added.
+
2007-11-15 Khoo Yit Phang <khooyp@cs.umd.edu>
Reviewed by Darin.
--- /dev/null
+This tests that we don't crash if a menu list's renderer is destroyed during the mouse down event.
+
--- /dev/null
+<html>
+ <head>
+ <script>
+ function test()
+ {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ var sl = document.getElementById('sl');
+ var event = document.createEvent("MouseEvent");
+ event.initMouseEvent("mousedown", true, true, window, 1, sl.offsetLeft, sl.offsetTop, sl.offsetLeft, sl.offsetTop, false, false, false, false, 0, document);
+ sl.dispatchEvent(event);
+ }
+ </script>
+ </head>
+ <body onload="test()">
+ This tests that we don't crash if a menu list's renderer is destroyed during the mouse down event.
+ <br>
+ <select id="sl" onmousedown="this.style.display='none'"><option>test</select>
+ </body>
+</html>
+2007-11-15 Adele Peterson <adele@apple.com>
+
+ Reviewed by Oliver.
+
+ Fix for <rdar://problem/5566652> CrashTracer: [USER] 3 crashes in Safari at HTMLSelectElement::menuListDefaultEventHandler (reproducible on mactc30.com)
+
+ Test: fast/forms/menulist-no-renderer-onmousedown.html
+
+ * html/HTMLSelectElement.cpp:
+ (WebCore::HTMLSelectElement::defaultEventHandler): Nil check the renderer here. None of the default behavior makes sense if there's no renderer.
+ (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Moved the nil check to the main defaultEventHandler.
+
2007-11-15 Antti Koivisto <antti@apple.com>
Reviewed by Adele.
void HTMLSelectElement::defaultEventHandler(Event* evt)
{
+ if (!renderer())
+ return;
+
if (usesMenuList())
menuListDefaultEventHandler(evt);
else
void HTMLSelectElement::listBoxDefaultEventHandler(Event* evt)
{
- if (!renderer())
- return;
-
if (evt->type() == mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
focus();