[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198
dglazkov at chromium.org
dglazkov at chromium.org
Sun Feb 20 23:33:39 UTC 2011
The following commit has been merged in the webkit-1.3 branch:
commit b06e57124d4cb959302d7a65b3f573fcfadf51f7
Author: dglazkov at chromium.org <dglazkov at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Jan 21 19:20:05 2011 +0000
2011-01-21 Dimitri Glazkov <dglazkov at chromium.org>
Reviewed by Darin Adler.
REGRESSION(r73618): Clicking on a search input causes a crash.
https://bugs.webkit.org/show_bug.cgi?id=52905
* fast/dom/search-shadow-host-crash-expected.txt: Added.
* fast/dom/search-shadow-host-crash.html: Added.
2011-01-21 Dimitri Glazkov <dglazkov at chromium.org>
Reviewed by Darin Adler.
REGRESSION(r73618): Clicking on a search input causes a crash.
https://bugs.webkit.org/show_bug.cgi?id=52905
The problem is caused by TextControlInnerElement being used both as
shadow root and an element in a shadow subtree. The code assumed it is
only used as a shadow root.
Since this code is all just workaround for in-progress conversion to
new shadow DOM, I am just adding a check. This code will disappear
completely once bug 52788 is fixed.
Test: fast/dom/search-shadow-host-crash.html
* dom/Node.cpp:
(WebCore::Node::setShadowHost): Added an ASSERT for early detection
of attempting to stomp on the parentNode.
* rendering/TextControlInnerElements.cpp:
(WebCore::TextControlInnerElement::detach): Added a check to only
clear shadow host if we have one.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76366 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 799565e..2f3df9c 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,5 +1,15 @@
2011-01-21 Dimitri Glazkov <dglazkov at chromium.org>
+ Reviewed by Darin Adler.
+
+ REGRESSION(r73618): Clicking on a search input causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=52905
+
+ * fast/dom/search-shadow-host-crash-expected.txt: Added.
+ * fast/dom/search-shadow-host-crash.html: Added.
+
+2011-01-21 Dimitri Glazkov <dglazkov at chromium.org>
+
Updated slider expectations after r76147.
* platform/chromium/test_expectations.txt: Removed test that will start passing.
diff --git a/LayoutTests/fast/dom/search-shadow-host-crash-expected.txt b/LayoutTests/fast/dom/search-shadow-host-crash-expected.txt
new file mode 100644
index 0000000..b4f1009
--- /dev/null
+++ b/LayoutTests/fast/dom/search-shadow-host-crash-expected.txt
@@ -0,0 +1,3 @@
+Click on the search box. This test passes if does not crash.
+
+
diff --git a/LayoutTests/fast/dom/search-shadow-host-crash.html b/LayoutTests/fast/dom/search-shadow-host-crash.html
new file mode 100644
index 0000000..d14c5a2
--- /dev/null
+++ b/LayoutTests/fast/dom/search-shadow-host-crash.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function clickOn(element)
+{
+ if (!window.eventSender)
+ return;
+
+ var x = element.offsetLeft + element.offsetWidth / 2;
+ var y = element.offsetTop + element.offsetHeight / 2;
+ eventSender.mouseMoveTo(x, y);
+ eventSender.mouseDown();
+ eventSender.mouseUp();
+}
+
+function runTest()
+{
+ clickOn(document.getElementsByTagName('input')[0]);
+}
+
+</script>
+</head>
+<body onload="runTest()">
+ <p>Click on the search box. This test passes if does not crash.</p>
+ <input type="search" onclick="this.style.display = 'none';">
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 0013f9e..d5caec8 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,27 @@
+2011-01-21 Dimitri Glazkov <dglazkov at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION(r73618): Clicking on a search input causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=52905
+
+ The problem is caused by TextControlInnerElement being used both as
+ shadow root and an element in a shadow subtree. The code assumed it is
+ only used as a shadow root.
+
+ Since this code is all just workaround for in-progress conversion to
+ new shadow DOM, I am just adding a check. This code will disappear
+ completely once bug 52788 is fixed.
+
+ Test: fast/dom/search-shadow-host-crash.html
+
+ * dom/Node.cpp:
+ (WebCore::Node::setShadowHost): Added an ASSERT for early detection
+ of attempting to stomp on the parentNode.
+ * rendering/TextControlInnerElements.cpp:
+ (WebCore::TextControlInnerElement::detach): Added a check to only
+ clear shadow host if we have one.
+
2011-01-21 Adam Roben <aroben at apple.com>
Replace some "sync compositing state" terminology with "flush pending GraphicsLayer changes"
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 2e42e84..cd72662 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -492,6 +492,7 @@ Element* Node::shadowHost() const
void Node::setShadowHost(Element* host)
{
+ ASSERT(!parentNode());
if (host)
setFlag(IsShadowRootFlag);
else
diff --git a/Source/WebCore/rendering/TextControlInnerElements.cpp b/Source/WebCore/rendering/TextControlInnerElements.cpp
index 26973f9..7b1b36f 100644
--- a/Source/WebCore/rendering/TextControlInnerElements.cpp
+++ b/Source/WebCore/rendering/TextControlInnerElements.cpp
@@ -119,7 +119,8 @@ void TextControlInnerElement::detach()
{
HTMLDivElement::detach();
// FIXME: Remove once shadow DOM uses Element::setShadowRoot().
- setShadowHost(0);
+ if (shadowHost())
+ setShadowHost(0);
}
// ----------------------------
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list