[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
dglazkov at chromium.org
dglazkov at chromium.org
Wed Dec 22 15:53:29 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit b341f0877fc5f07999d36594c4e8bbeff8093267
Author: dglazkov at chromium.org <dglazkov at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Nov 16 05:35:34 2010 +0000
2010-11-15 Dimitri Glazkov <dglazkov at chromium.org>
Reviewed by Darin Adler.
REGRESSION(r71934): Removing an element with a shadow DOM from under a cursor causes a crash.
https://bugs.webkit.org/show_bug.cgi?id=49569
* fast/events/remove-shadow-host-crash-expected.txt: Added.
* fast/events/remove-shadow-host-crash.html: Added.
2010-11-15 Dimitri Glazkov <dglazkov at chromium.org>
Reviewed by Darin Adler.
REGRESSION(r71934): Removing an element with a shadow DOM from under a cursor causes a crash.
https://bugs.webkit.org/show_bug.cgi?id=49569
Test: fast/events/remove-shadow-host-crash.html
* rendering/TextControlInnerElements.h:
(WebCore::TextControlInnerElement::isShadowNode):
(WebCore::TextControlInnerElement::shadowParentNode):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@72062 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6cd927d..b68589b 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-11-15 Dimitri Glazkov <dglazkov at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION(r71934): Removing an element with a shadow DOM from under a cursor causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=49569
+
+ * fast/events/remove-shadow-host-crash-expected.txt: Added.
+ * fast/events/remove-shadow-host-crash.html: Added.
+
2010-11-15 Kent Tamura <tkent at chromium.org>
Unreviewed, test expectation update.
diff --git a/LayoutTests/fast/events/remove-shadow-host-crash-expected.txt b/LayoutTests/fast/events/remove-shadow-host-crash-expected.txt
new file mode 100644
index 0000000..264969f
--- /dev/null
+++ b/LayoutTests/fast/events/remove-shadow-host-crash-expected.txt
@@ -0,0 +1,5 @@
+Ensures that a "mouseout" event, fired on shadow DOM element of a destroyed host element doesn't crash the browser.
+
+Passes if doesn't crash.
+
+
diff --git a/LayoutTests/fast/events/remove-shadow-host-crash.html b/LayoutTests/fast/events/remove-shadow-host-crash.html
new file mode 100644
index 0000000..4c91104
--- /dev/null
+++ b/LayoutTests/fast/events/remove-shadow-host-crash.html
@@ -0,0 +1,35 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function mouseOver(element)
+{
+ if (!window.eventSender)
+ return;
+
+ var x = element.offsetLeft + element.offsetWidth / 2;
+ var y = element.offsetTop + element.offsetHeight / 2;
+ eventSender.mouseMoveTo(x, y);
+}
+
+function runTest()
+{
+ var area = document.getElementById('area');
+ mouseOver(area);
+ area.innerHTML = '';
+ mouseOver(document.getElementById('description'));
+}
+
+</script>
+</head>
+<body onload="runTest()">
+ <p id="description">Ensures that a "mouseout" event, fired on shadow DOM element of a destroyed host element doesn't crash the browser.
+ <p>Passes if doesn't crash.
+ <div id="area" style="width:100px;height:100px">
+ <textarea style="width:100px;height:100px">Foo</textarea>
+ </div>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index a434683..3f8a4e9 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-11-15 Dimitri Glazkov <dglazkov at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION(r71934): Removing an element with a shadow DOM from under a cursor causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=49569
+
+ Test: fast/events/remove-shadow-host-crash.html
+
+ * rendering/TextControlInnerElements.h:
+ (WebCore::TextControlInnerElement::isShadowNode):
+ (WebCore::TextControlInnerElement::shadowParentNode):
+
2010-11-12 Ryosuke Niwa <rniwa at webkit.org>
Reviewed by Darin Adler.
diff --git a/WebCore/rendering/TextControlInnerElements.h b/WebCore/rendering/TextControlInnerElements.h
index 61c9dba..51c9aff 100644
--- a/WebCore/rendering/TextControlInnerElements.h
+++ b/WebCore/rendering/TextControlInnerElements.h
@@ -47,12 +47,12 @@ protected:
private:
virtual bool isMouseFocusable() const { return false; }
- virtual bool isShadowNode() const { return m_shadowParent; }
- virtual ContainerNode* shadowParentNode() { return m_shadowParent; }
+ virtual bool isShadowNode() const { return m_shadowParent.get(); }
+ virtual ContainerNode* shadowParentNode() { return m_shadowParent.get(); }
virtual bool isSpellCheckingEnabled() const;
void setShadowParentNode(HTMLElement* shadowParent) { m_shadowParent = shadowParent; }
- HTMLElement* m_shadowParent;
+ RefPtr<HTMLElement> m_shadowParent;
};
class TextControlInnerTextElement : public TextControlInnerElement {
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list