Changeset 107324 in webkit

Timestamp:

Feb 9, 2012, 5:24:14 PM (15 years ago)

Author:

cevans@google.com

Message:

Merge 106771
BUG=112735
Review URL: ​https://chromiumcodereview.appspot.com/9369055

Location:

branches/chromium/963

Files:

• LayoutTests/fast/forms/form-submission-create-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/forms/form-submission-create-crash-expected.txt )
• LayoutTests/fast/forms/form-submission-create-crash.xhtml (copied) (copied from trunk/LayoutTests/fast/forms/form-submission-create-crash.xhtml )
• Source/WebCore/loader/FormSubmission.cpp (modified) (1 diff)

branches/chromium/963/Source/WebCore/loader/FormSubmission.cpp

@@ -143 +143 @@
 
     HTMLFormControlElement* submitButton = 0;
-    if (event && event->target() && event->target()->toNode())
-        submitButton = static_cast<HTMLFormControlElement*>(event->target()->toNode());
+    if (event && event->target()) {
+        Node* node = event->target()->toNode();
+        if (node && node->isElementNode() && toElement(node)->isFormControlElement())
+            submitButton = static_cast<HTMLFormControlElement*>(node);
+    }
 
     FormSubmission::Attributes copiedAttributes;