Changeset 207208 in webkit

Timestamp:

Oct 12, 2016 1:41:44 AM (8 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r205861. rdar://problem/28409523

Location:

branches/safari-602-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/assert-on-input-type-change-expected.txt (added)
• LayoutTests/fast/forms/assert-on-input-type-change.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/ImageInputType.cpp (modified) (1 diff)

branches/safari-602-branch/LayoutTests/ChangeLog

@@ +1 @@
+2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r205861. rdar://problem/28409523
+
+    2016-09-12  Zalan Bujtas  <zalan@apple.com>
+
+            Input type object and the associated render can go out of sync.
+            https://bugs.webkit.org/show_bug.cgi?id=161871
+            <rdar://problem/28178094>
+
+            Reviewed by Antti Koivisto.
+
+            * fast/forms/assert-on-input-type-change-expected.txt: Added.
+            * fast/forms/assert-on-input-type-change.html: Added.
+
 2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-602-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r205861. rdar://problem/28409523
+
+    2016-09-12  Zalan Bujtas  <zalan@apple.com>
+
+            Input type object and the associated render can go out of sync.
+            https://bugs.webkit.org/show_bug.cgi?id=161871
+            <rdar://problem/28178094>
+
+            Reviewed by Antti Koivisto.
+
+            Bail out when we've got a mismatched renderer.
+
+            Test: fast/forms/assert-on-input-type-change.html
+
+            * html/ImageInputType.cpp:
+            (WebCore::ImageInputType::altAttributeChanged):
+
 2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-602-branch/Source/WebCore/html/ImageInputType.cpp

@@ -110 +110 @@
 void ImageInputType::altAttributeChanged()
 {
+    if (!is<RenderImage>(element().renderer()))
+        return;
+
     auto* renderer = downcast<RenderImage>(element().renderer());
     if (!renderer)