Changeset 116864 in webkit

Timestamp:

May 12, 2012, 9:22:42 PM (14 years ago)

Author:

inferno@chromium.org

Message:

Crash in HTMLSelectElement::setOption
​https://bugs.webkit.org/show_bug.cgi?id=85420

Source/WebCore:

Reviewed by Eric Seidel

RefPtr before option in HTMLSelectElement::setOption since it
can get destroyed due to mutation events.

Test: fast/dom/HTMLSelectElement/option-add-crash.html

• html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::setOption):

LayoutTests:

Reviewed by Eric Seidel.

• fast/dom/HTMLSelectElement/option-add-crash-expected.txt: Added.
• fast/dom/HTMLSelectElement/option-add-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt (added)
• LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLSelectElement.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-05-12  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in HTMLSelectElement::setOption
+        https://bugs.webkit.org/show_bug.cgi?id=85420
+
+        Reviewed by Eric Seidel.
+
+        * fast/dom/HTMLSelectElement/option-add-crash-expected.txt: Added.
+        * fast/dom/HTMLSelectElement/option-add-crash.html: Added.
+
 2012-05-12  Philip Rogers  <pdr@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-12  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in HTMLSelectElement::setOption
+        https://bugs.webkit.org/show_bug.cgi?id=85420
+
+        Reviewed by Eric Seidel
+        
+        RefPtr before option in HTMLSelectElement::setOption since it
+        can get destroyed due to mutation events.
+
+        Test: fast/dom/HTMLSelectElement/option-add-crash.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setOption):
+
 2012-05-12  Robin Dunn  <robin@alldunn.com>
 

trunk/Source/WebCore/html/HTMLSelectElement.cpp

@@ -414 +414 @@
         index = maxSelectItems - 1;
     int diff = index - length();
-    HTMLElement* before = 0;
+    RefPtr<HTMLElement> before = 0;
     // Out of array bounds? First insert empty dummies.
     if (diff > 0) {
@@ -425 +425 @@
     // Finally add the new element.
     if (!ec) {
-        add(option, before, ec);
+        add(option, before.get(), ec);
         if (diff >= 0 && option->selected())
             optionSelectionStateChanged(option, true);