Changeset 121930 in webkit

Timestamp:

Jul 5, 2012 5:26:39 PM (12 years ago)

Author:

hayato@chromium.org

Message:

t/fuzzer-mouse-crash

<patch description>

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/display-none-on-focus-crash-expected.txt (added)
• LayoutTests/fast/events/display-none-on-focus-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/EventHandler.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-07-05  Hayato Ito  <hayato@chromium.org>
+
+        [Crash] Click an element which will be 'display: none' on focus.
+        https://bugs.webkit.org/show_bug.cgi?id=90516
+
+        Reviewed by Hajime Morita.
+
+        * fast/events/display-none-on-focus-crash-expected.txt: Added.
+        * fast/events/display-none-on-focus-crash.html: Added.
+
 2012-07-05  Leandro Gracia Gil  <leandrogracia@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-07-05  Hayato Ito  <hayato@chromium.org>
+
+        [Crash] Click an element which will be 'display: none' on focus.
+        https://bugs.webkit.org/show_bug.cgi?id=90516
+
+        Reviewed by Hajime Morita.
+
+        EventHandler::handleMousePressEventSingleClick checks whether
+        innerNode has a renderer in the beginning of the function.  But
+        the renderer may disappear in the middle of the function since its
+        style has just become 'display:none'.  As a result, it touches null renderer
+        in EventHandler.cpp:517:
+            VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
+        In the case of 'display:none', we don't have to continue.  So call
+        updateLayoutIgnorePendingStylesheets() in the beginning so that we
+        can early exit and do not touch null renderer.
+
+        Test: fast/events/display-none-on-focus-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
 2012-07-05  Benjamin Poulain  <bpoulain@apple.com>
 

trunk/Source/WebCore/page/EventHandler.cpp

@@ -497 +497 @@
 bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestResults& event)
 {
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
     Node* innerNode = targetNode(event);
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))