Changeset 106488 in webkit

Timestamp:

Feb 1, 2012 1:34:08 PM (12 years ago)

Author:

rniwa@webkit.org

Message:

Crash in EventHandler::updateDragAndDrop
​https://bugs.webkit.org/show_bug.cgi?id=77569

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test: fast/events/remove-target-with-shadow-in-drag.html

• page/EventHandler.cpp:

(WebCore::EventHandler::updateDragAndDrop):

LayoutTests:

• fast/events/remove-target-with-shadow-in-drag-expected.txt: Added.
• fast/events/remove-target-with-shadow-in-drag.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt (added)
• LayoutTests/fast/events/remove-target-with-shadow-in-drag.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/EventHandler.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-02-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in EventHandler::updateDragAndDrop
+        https://bugs.webkit.org/show_bug.cgi?id=77569
+
+        Reviewed by Alexey Proskuryakov.
+
+        * fast/events/remove-target-with-shadow-in-drag-expected.txt: Added.
+        * fast/events/remove-target-with-shadow-in-drag.html: Added.
+
 2012-02-01  Szilard Ledan  <Ledan-Muntean.Szilard@stud.u-szeged.hu>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in EventHandler::updateDragAndDrop
+        https://bugs.webkit.org/show_bug.cgi?id=77569
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: fast/events/remove-target-with-shadow-in-drag.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
 2012-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/Source/WebCore/page/EventHandler.cpp

@@ -1838 +1838 @@
 
     // Drag events should never go to text nodes (following IE, and proper mouseover/out dispatch)
-    Node* newTarget = targetNode(mev);
+    RefPtr<Node> newTarget = targetNode(mev);
     if (newTarget && newTarget->isTextNode())
         newTarget = newTarget->parentNode();
@@ -1851 +1851 @@
         // Moreover, this ordering conforms to section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>.
         Frame* targetFrame;
-        if (targetIsFrame(newTarget, targetFrame)) {
+        if (targetIsFrame(newTarget.get(), targetFrame)) {
             if (targetFrame)
                 accept = targetFrame->eventHandler()->updateDragAndDrop(event, clipboard);
@@ -1860 +1860 @@
                 dispatchDragSrcEvent(eventNames().dragEvent, event);
             }
-            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
+            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget.get(), event, clipboard);
             if (!accept)
-                accept = findDropZone(newTarget, clipboard);
+                accept = findDropZone(newTarget.get(), clipboard);
         }
 
@@ -1878 +1878 @@
     } else {
         Frame* targetFrame;
-        if (targetIsFrame(newTarget, targetFrame)) {
+        if (targetIsFrame(newTarget.get(), targetFrame)) {
             if (targetFrame)
                 accept = targetFrame->eventHandler()->updateDragAndDrop(event, clipboard);
@@ -1887 +1887 @@
                 dispatchDragSrcEvent(eventNames().dragEvent, event);
             }
-            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget.get(), event, clipboard);
             if (!accept)
-                accept = findDropZone(newTarget, clipboard);
+                accept = findDropZone(newTarget.get(), clipboard);
             m_shouldOnlyFireDragOverEvent = false;
         }