Search field in designMode causes a crash
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 1 Aug 2011 21:08:17 +0000 (21:08 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 1 Aug 2011 21:08:17 +0000 (21:08 +0000)
https://bugs.webkit.org/show_bug.cgi?id=65362

Reviewed by Dimitri Glazkov.

Source/WebCore:

The crashed was caused by editing code inadvertently deleting search and cancel buttons in the design mode.
Fixed the bug by avoid inheriting user-modify property from the shadow host.

Test: editing/input/search-field-crash-in-designmode.html

* css/CSSStyleSelector.cpp:
(WebCore::isAtShadowBoundary): Moved.
(WebCore::CSSStyleSelector::styleForElement): Overrides -webkit-user-modify by the initial value after m_style
inherited the values from m_parentStyle but before applying matched rules.
* dom/Node.cpp:
(WebCore::Node::rendererIsEditable): Ignore page's editability inside a shadow DOM.

LayoutTests:

Add a test to ensure WebKit doesn't crash when a user tries to delete inside
an empty search field in the design mode.

* editing/input/search-field-crash-in-designmode-expected.txt: Added.
* editing/input/search-field-crash-in-designmode.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92139 268f45cc-cd09-0410-ab3c-d52691b4dbfc


No differences found