Reviewed by Eric.
authormjs <mjs@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 30 Jan 2007 11:09:31 +0000 (11:09 +0000)
committermjs <mjs@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 30 Jan 2007 11:09:31 +0000 (11:09 +0000)
        <rdar://problem/4928646> REGRESSION: manual-tests/remove-input-file-onchange.html crashes

        * platform/FileChooser.h:
        (WebCore::FileChooser::disconnected): New method, so the RenderFileControl can tell when it's
        gotten disconected.
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::valueChanged): Avoid calling repainted() when onChange()
        handler destroyed us.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@19252 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore/ChangeLog
WebCore/platform/FileChooser.h
WebCore/rendering/RenderFileUploadControl.cpp

index 2ba0b08c1c5f98e51c5947342c19396cfb3562c2..c9e05d227206684609f88b3a3c0e8335ebdfa000 100644 (file)
@@ -1,3 +1,16 @@
+2007-01-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        <rdar://problem/4928646> REGRESSION: manual-tests/remove-input-file-onchange.html crashes
+        
+        * platform/FileChooser.h:
+        (WebCore::FileChooser::disconnected): New method, so the RenderFileControl can tell when it's
+        gotten disconected.
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::valueChanged): Avoid calling repainted() when onChange()
+        handler destroyed us.
+
 2007-01-30  Simon Hausmann  <hausmann@kde.org>
 
         Reviewed by Zack.
index 63f9d732a9e42aebf73cc967e9437bd64e948a62..7d3884a3219ddd5144ae61c89b5b2ec86b8d3f46 100644 (file)
@@ -60,6 +60,7 @@ public:
     ~FileChooser();
 
     void disconnectClient() { m_client = 0; }
+    bool disconnected() { return !m_client; }
 
     // FIXME: It's a layering violation that we pass a Document in here.
     // The platform directory is underneath the DOM, so it can't use the DOM.
index 1103d5075bc238c919ce250af6698839dbb5bd44..7be9f7815997e5ce053ffed3ea4612e17dbabb21 100644 (file)
@@ -89,9 +89,15 @@ void RenderFileUploadControl::setStyle(RenderStyle* newStyle)
 
 void RenderFileUploadControl::valueChanged()
 {
+    // onChange may destroy this renderer
+    RefPtr<FileChooser> fileChooser = m_fileChooser;
+
     static_cast<HTMLInputElement*>(node())->setValueFromRenderer(m_fileChooser->filename());
     static_cast<HTMLInputElement*>(node())->onChange();
-    repaint();
+    // only repaint if it doesn't seem we have been destroyed
+    if (!fileChooser->disconnected())
+        repaint();
 }
 
 void RenderFileUploadControl::click()