Changeset 157956 in webkit

Timestamp:

Oct 24, 2013, 2:31:11 PM (13 years ago)

Author:

Lucas Forschler

Message:

Merged r154308. <rdar://problem/15109394>

Location:

branches/safari-537.73-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/range/range-type-change-oninput-expected.txt (copied) (copied from trunk/LayoutTests/fast/forms/range/range-type-change-oninput-expected.txt )
• LayoutTests/fast/forms/range/range-type-change-oninput.html (copied) (copied from trunk/LayoutTests/fast/forms/range/range-type-change-oninput.html )
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/shadow/SliderThumbElement.cpp (modified) (5 diffs)

branches/safari-537.73-branch/LayoutTests/ChangeLog

@@ +1 @@
+2013-10-24  Lucas Forschler  <lforschler@apple.com>
+
+        Merge r154308
+
+    2013-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+            <https://webkit.org/b/119930> input[type=range]: Fix a crash by changing input type in 'input' event handler
+
+            Reviewed by Kent Tamura.
+
+            Add a regresion test from https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5
+
+            * fast/forms/range/range-type-change-oninput-expected.txt: Added.
+            * fast/forms/range/range-type-change-oninput.html: Added.
+
 2013-10-24  Oliver Hunt  <oliver@apple.com>
 

branches/safari-537.73-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2013-10-24  Lucas Forschler  <lforschler@apple.com>
+
+        Merge r154308
+
+    2013-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+            <https://webkit.org/b/119930> input[type=range]: Fix a crash by changing input type in 'input' event handler
+
+            Reviewed by Kent Tamura.
+
+            Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5
+
+            In SliderThumbElement::setPositionFromPoint, renderer() can be NULL after HTMLInputElement::setValueFromRenderer,
+            which dispatches 'input' event. Also, make a local vairable 'input' a RefPtr just in case.
+
+            Also add null-poinetr checks for the host element as SliderThumbElement only weakly holds onto the host element.
+
+            Test: fast/forms/range/range-type-change-oninput.html
+
+            * html/shadow/SliderThumbElement.cpp:
+            (WebCore::SliderThumbElement::isDisabledFormControl):
+            (WebCore::SliderThumbElement::matchesReadOnlyPseudoClass):
+            (WebCore::SliderThumbElement::matchesReadWritePseudoClass):
+            (WebCore::SliderThumbElement::setPositionFromPoint):
+            (WebCore::SliderThumbElement::hostInput):
+
 2013-10-21  Lucas Forschler  <lforschler@apple.com>
 

branches/safari-537.73-branch/Source/WebCore/html/shadow/SliderThumbElement.cpp

@@ -225 +225 @@
 bool SliderThumbElement::isDisabledFormControl() const
 {
-    return hostInput()->isDisabledFormControl();
+    HTMLInputElement* input = hostInput();
+    return !input || input->isDisabledFormControl();
 }
 
 bool SliderThumbElement::matchesReadOnlyPseudoClass() const
 {
-    return hostInput()->matchesReadOnlyPseudoClass();
+    HTMLInputElement* input = hostInput();
+    return input && input->matchesReadOnlyPseudoClass();
 }
 
 bool SliderThumbElement::matchesReadWritePseudoClass() const
 {
-    return hostInput()->matchesReadWritePseudoClass();
+    HTMLInputElement* input = hostInput();
+    return input && input->matchesReadWritePseudoClass();
 }
 
@@ -251 +254 @@
 void SliderThumbElement::setPositionFromPoint(const LayoutPoint& point)
 {
-    HTMLInputElement* input = hostInput();
-    HTMLElement* trackElement = sliderTrackElementOf(input);
+    RefPtr<HTMLInputElement> input(hostInput());
+    HTMLElement* trackElement = sliderTrackElementOf(input.get());
 
     if (!input->renderer() || !renderBox() || !trackElement->renderBox())
@@ -259 +262 @@
     input->setTextAsOfLastFormControlChangeEvent(input->value());
     LayoutPoint offset = roundedLayoutPoint(input->renderer()->absoluteToLocal(point, UseTransforms));
-    bool isVertical = hasVerticalAppearance(input);
+    bool isVertical = hasVerticalAppearance(input.get());
     bool isLeftToRightDirection = renderBox()->style()->isLeftToRightDirection();
     LayoutUnit trackSize;
@@ -308 +311 @@
     // FIXME: This is no longer being set from renderer. Consider updating the method name.
     input->setValueFromRenderer(valueString);
-    renderer()->setNeedsLayout(true);
+    if (renderer())
+        renderer()->setNeedsLayout(true);
     input->dispatchFormControlChangeEvent();
 }
@@ -401 +405 @@
     // Only HTMLInputElement creates SliderThumbElement instances as its shadow nodes.
     // So, shadowHost() must be an HTMLInputElement.
-    return shadowHost()->toInputElement();
+    Element* host = shadowHost();
+    return host ? host->toInputElement() : 0;
 }