Assertion failure by form validation message for <select required> with float:left
authortkent@chromium.org <tkent@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 15 Mar 2011 00:53:53 +0000 (00:53 +0000)
committertkent@chromium.org <tkent@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 15 Mar 2011 00:53:53 +0000 (00:53 +0000)
https://bugs.webkit.org/show_bug.cgi?id=55995

Reviewed by James Robinson.

Source/WebCore:

Test: fast/forms/interactive-validation-select-crash.html

* rendering/RenderBlock.cpp:
(WebCore::canMergeContiguousAnonymousBlocks):
  isAnonymousBlock() doesn't mean it is a RenderBlock. We need to check isRenderBlock().

LayoutTests:

* fast/forms/interactive-validation-select-crash-expected.txt: Added.
* fast/forms/interactive-validation-select-crash.html: Added.
* platform/gtk/Skipped:
* platform/mac/Skipped:
* platform/qt/Skipped:
* platform/win/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@81088 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/forms/interactive-validation-select-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/forms/interactive-validation-select-crash.html [new file with mode: 0644]
LayoutTests/platform/gtk/Skipped
LayoutTests/platform/mac/Skipped
LayoutTests/platform/qt/Skipped
LayoutTests/platform/win/Skipped
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp

index b1eb2c8..96d0adf 100644 (file)
@@ -1,3 +1,17 @@
+2011-03-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Assertion failure by form validation message for <select required> with float:left
+        https://bugs.webkit.org/show_bug.cgi?id=55995
+
+        * fast/forms/interactive-validation-select-crash-expected.txt: Added.
+        * fast/forms/interactive-validation-select-crash.html: Added.
+        * platform/gtk/Skipped:
+        * platform/mac/Skipped:
+        * platform/qt/Skipped:
+        * platform/win/Skipped:
+
 2011-03-14  Michael Saboff  <msaboff@apple.com>
 
         Reviewed by Gavin Barraclough.
diff --git a/LayoutTests/fast/forms/interactive-validation-select-crash-expected.txt b/LayoutTests/fast/forms/interactive-validation-select-crash-expected.txt
new file mode 100644 (file)
index 0000000..a051400
--- /dev/null
@@ -0,0 +1,7 @@
+Test for a bug that RenderBlock crashed when a validation message bubble for a select element with float:left was closing.
+
+PASS Not crashed.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/interactive-validation-select-crash.html b/LayoutTests/fast/forms/interactive-validation-select-crash.html
new file mode 100644 (file)
index 0000000..4359042
--- /dev/null
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p>Test for a bug that RenderBlock crashed when a validation message bubble for a select element with float:left was closing.</p>
+<div id=console></div>
+<form>
+<select style="float:left" required>
+<option value="">Plese select</option>
+<option>Foo</option>
+</select>
+<input type=submit id=submit>
+</form>
+
+<script>
+window.jsTestIsAsync = true;
+
+function closeBubble() {
+    // Make the <select> valid to close the validation message bubble.
+    document.getElementsByTagName('select')[0].selectedIndex = 1;
+    setTimeout(finish, 0);
+}
+function finish() {
+    testPassed('Not crashed.');
+    finishJSTest();
+}
+
+document.getElementById('submit').click();
+setTimeout(closeBubble, 0);
+
+var successfullyParsed = true;
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
index 8a7381d..6948756 100644 (file)
@@ -1117,6 +1117,7 @@ fast/forms/interactive-validation-lost-focusable.html
 fast/forms/interactive-validation-prevented.html
 fast/forms/interactive-validation-attach-assertion.html
 fast/forms/interactive-validation-assertion-by-validate-twice.html
+fast/forms/interactive-validation-select-crash.html
 
 # Tests that seem to be Mac only, assume that smart drag-and-drop
 # is enabled or assume platform-dependent sizing.
index 7211d8a..869334b 100644 (file)
@@ -206,6 +206,7 @@ fast/forms/interactive-validation-lost-focusable.html
 fast/forms/interactive-validation-prevented.html
 fast/forms/interactive-validation-attach-assertion.html
 fast/forms/interactive-validation-assertion-by-validate-twice.html
+fast/forms/interactive-validation-select-crash.html
 
 # Web Timing is not enabled.
 # https://bugs.webkit.org/show_bug.cgi?id=42434
index b4db2bd..7a23404 100644 (file)
@@ -2969,6 +2969,7 @@ fast/forms/interactive-validation-lost-focusable.html
 fast/forms/interactive-validation-prevented.html
 fast/forms/interactive-validation-attach-assertion.html
 fast/forms/interactive-validation-assertion-by-validate-twice.html
+fast/forms/interactive-validation-select-crash.html
 
 # [Qt] REGRESSION(63862): animations/play-state.html fails intermittently
 # https://bugs.webkit.org/show_bug.cgi?id=42821
index b361c62..53f4255 100644 (file)
@@ -1066,6 +1066,7 @@ fast/forms/interactive-validation-lost-focusable.html
 fast/forms/interactive-validation-prevented.html
 fast/forms/interactive-validation-attach-assertion.html
 fast/forms/interactive-validation-assertion-by-validate-twice.html
+fast/forms/interactive-validation-select-crash.html
 
 # Web Timing is not enabled.
 # https://bugs.webkit.org/show_bug.cgi?id=42435
index c41c4f4..c05e7bc 100644 (file)
@@ -1,3 +1,16 @@
+2011-03-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Assertion failure by form validation message for <select required> with float:left
+        https://bugs.webkit.org/show_bug.cgi?id=55995
+
+        Test: fast/forms/interactive-validation-select-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks):
+          isAnonymousBlock() doesn't mean it is a RenderBlock. We need to check isRenderBlock().
+
 2011-03-14  Balazs Kelemen  <kbalazs@webkit.org>
 
         Reviewed by Adam Roben.
index f5fb89d..4038409 100644 (file)
@@ -933,8 +933,8 @@ static bool canMergeContiguousAnonymousBlocks(RenderObject* oldChild, RenderObje
     if (oldChild->documentBeingDestroyed() || oldChild->isInline() || oldChild->virtualContinuation())
         return false;
 
-    if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
-        || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
+    if ((prev && (!prev->isAnonymousBlock() || !prev->isRenderBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
+        || (next && (!next->isAnonymousBlock() || !next->isRenderBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
         return false;
 
     // FIXME: This check isn't required when inline run-ins can't be split into continuations.