Changeset 230400 in webkit
- Timestamp:
- Apr 9, 2018 3:53:14 AM (6 years ago)
- Location:
- releases/WebKitGTK/webkit-2.20
- Files:
-
- 4 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
releases/WebKitGTK/webkit-2.20/LayoutTests/ChangeLog
r230399 r230400 1 2018-03-07 Zalan Bujtas <zalan@apple.com> 2 3 Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange() 4 https://bugs.webkit.org/show_bug.cgi?id=183385 5 <rdar://problem/38085397> 6 7 Reviewed by Antti Koivisto. 8 9 * fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt: Added. 10 * fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html: Added. 11 1 12 2018-03-07 Sihui Liu <sihui_liu@apple.com> 2 13 -
releases/WebKitGTK/webkit-2.20/Source/WebCore/ChangeLog
r230399 r230400 1 2018-03-07 Zalan Bujtas <zalan@apple.com> 2 3 Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange() 4 https://bugs.webkit.org/show_bug.cgi?id=183385 5 <rdar://problem/38085397> 6 7 Reviewed by Antti Koivisto. 8 9 When HTMLInputElement::updateType() is called with a dirty value, we eagerly change the m_inputType first 10 and then we take care of the dirty value by calling setAttributeWithoutSynchronization(). 11 With a DOMSubtreeModified event listener attached, setAttributeWithoutSynchronization() can end up running some 12 layout code (offsetHeight) with a renderer - m_inputType mismatch. 13 14 This patch ensures that we don't change the m_inputType until after we finished setting the new value. 15 16 Test: fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html 17 18 * html/HTMLInputElement.cpp: 19 (WebCore::HTMLInputElement::updateType): 20 1 21 2018-03-07 Sihui Liu <sihui_liu@apple.com> 2 22 -
releases/WebKitGTK/webkit-2.20/Source/WebCore/html/HTMLInputElement.cpp
r227092 r230400 492 492 493 493 bool didStoreValue = m_inputType->storesValueSeparateFromAttribute(); 494 bool willStoreValue = newType->storesValueSeparateFromAttribute(); 494 495 bool neededSuspensionCallback = needsSuspensionCallback(); 495 496 bool didRespectHeightAndWidth = m_inputType->shouldRespectHeightAndWidthAttributes(); 496 497 bool wasSuccessfulSubmitButtonCandidate = m_inputType->canBeSuccessfulSubmitButton(); 497 498 499 if (didStoreValue && !willStoreValue && hasDirtyValue()) { 500 setAttributeWithoutSynchronization(valueAttr, m_valueIfDirty); 501 m_valueIfDirty = String(); 502 } 503 498 504 m_inputType->destroyShadowSubtree(); 499 505 … … 504 510 setNeedsWillValidateCheck(); 505 511 506 bool willStoreValue = m_inputType->storesValueSeparateFromAttribute();507 508 if (didStoreValue && !willStoreValue && hasDirtyValue()) {509 setAttributeWithoutSynchronization(valueAttr, m_valueIfDirty);510 m_valueIfDirty = String();511 }512 512 if (!didStoreValue && willStoreValue) 513 513 m_valueIfDirty = sanitizeValue(attributeWithoutSynchronization(valueAttr));
Note: See TracChangeset
for help on using the changeset viewer.