Changeset 185955 in webkit

Timestamp:

Jun 25, 2015, 10:42:00 AM (10 years ago)

Author:

Alan Bujtas

Message:

Do not send touch events to the slider's thumb when it does not have a renderer.
​https://bugs.webkit.org/show_bug.cgi?id=146307
rdar://problem/21539399

Reviewed by Simon Fraser.

Bail out early if either the touch target or the renderer() is null.

Source/WebCore:

Test: fast/events/touch/input-range-with-thumb-display-none-crash.html

• html/shadow/SliderThumbElement.cpp:

(WebCore::findTouchWithIdentifier):
(WebCore::SliderThumbElement::handleTouchStart):
(WebCore::SliderThumbElement::handleTouchMove):
(WebCore::SliderThumbElement::handleTouchEndAndCancel):

LayoutTests:

• fast/events/touch/input-range-with-thumb-display-none-crash-expected.txt: Added.
• fast/events/touch/input-range-with-thumb-display-none-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/ios-simulator/ios/touch/input-range-with-thumb-display-none-crash-expected.txt (added)
• LayoutTests/platform/ios-simulator/ios/touch/input-range-with-thumb-display-none-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/shadow/SliderThumbElement.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-06-25  Zalan Bujtas  <zalan@apple.com>
+
+        Do not send touch events to the slider's thumb when it does not have a renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=146307
+        rdar://problem/21539399
+
+        Reviewed by Simon Fraser.
+
+        Bail out early if either the touch target or the renderer() is null.
+
+        * fast/events/touch/input-range-with-thumb-display-none-crash-expected.txt: Added.
+        * fast/events/touch/input-range-with-thumb-display-none-crash.html: Added.
+
 2015-06-25  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-06-25  Zalan Bujtas  <zalan@apple.com>
+
+        Do not send touch events to the slider's thumb when it does not have a renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=146307
+        rdar://problem/21539399
+
+        Reviewed by Simon Fraser.
+
+        Bail out early if either the touch target or the renderer() is null.
+
+        Test: fast/events/touch/input-range-with-thumb-display-none-crash.html
+
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::findTouchWithIdentifier):
+        (WebCore::SliderThumbElement::handleTouchStart):
+        (WebCore::SliderThumbElement::handleTouchMove):
+        (WebCore::SliderThumbElement::handleTouchEndAndCancel):
+
 2015-06-25  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>
 

trunk/Source/WebCore/html/shadow/SliderThumbElement.cpp

@@ -419 +419 @@
 }
 
-static Touch* findTouchWithIdentifier(TouchList* list, unsigned identifier)
-{
-    unsigned length = list->length();
+static Touch* findTouchWithIdentifier(TouchList& list, unsigned identifier)
+{
+    unsigned length = list.length();
     for (unsigned i = 0; i < length; ++i) {
-        Touch* touch = list->item(i);
+        Touch* touch = list.item(i);
         if (touch->identifier() == identifier)
             return touch;
@@ -433 +433 @@
 {
     TouchList* targetTouches = touchEvent->targetTouches();
+    if (!targetTouches)
+        return;
+
     if (targetTouches->length() != 1)
         return;
 
+    Touch* touch = targetTouches->item(0);
+    if (!renderer())
+        return;
+    IntRect boundingBox = renderer()->absoluteBoundingBoxRect();
     // Ignore the touch if it is not really inside the thumb.
-    Touch* touch = targetTouches->item(0);
-    IntRect boundingBox = renderer()->absoluteBoundingBoxRect();
     if (!boundingBox.contains(touch->pageX(), touch->pageY()))
         return;
@@ -454 +459 @@
         return;
 
-    Touch* touch = findTouchWithIdentifier(touchEvent->targetTouches(), identifier);
+    TouchList* targetTouches = touchEvent->targetTouches();
+    if (!targetTouches)
+        return;
+
+    Touch* touch = findTouchWithIdentifier(*targetTouches, identifier);
     if (!touch)
         return;
@@ -469 +478 @@
         return;
 
+    TouchList* targetTouches = touchEvent->targetTouches();
+    if (!targetTouches)
+        return;
     // If our exclusive touch still exists, it was not the touch
     // that ended, so we should not stop dragging.
-    Touch* exclusiveTouch = findTouchWithIdentifier(touchEvent->targetTouches(), identifier);
+    Touch* exclusiveTouch = findTouchWithIdentifier(*targetTouches, identifier);
     if (exclusiveTouch)
         return;