Changeset 167805 in webkit

Timestamp:

Apr 25, 2014 7:28:24 AM (10 years ago)

Author:

commit-queue@webkit.org

Message:

Web process is crashed during dispatching touchEvent created by JS.
​https://bugs.webkit.org/show_bug.cgi?id=113225

Patch by Miyoung Shin <​myid.shin@samsung.com> on 2014-04-25
Reviewed by Benjamin Poulain.

TouchEvent created by JS should have the necessary attributes
of touches, targetTouches and changedTouches.
It should be verified weather there are touchLists before dispatching touch event.

Source/WebCore:
Test: fast/events/touch/create-touch-event-without-touchList.html

• dom/EventDispatcher.cpp:

(WebCore::EventDispatcher::dispatchEvent):
(WebCore::EventPath::updateTouchLists):
(WebCore::addRelatedNodeResolversForTouchList): Deleted.

LayoutTests:

• fast/events/touch/create-touch-event-without-touchList-expected.txt: Added.
• fast/events/touch/create-touch-event-without-touchList.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/touch/create-touch-event-without-touchList-expected.txt (added)
• LayoutTests/fast/events/touch/create-touch-event-without-touchList.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/EventDispatcher.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-04-25  Miyoung Shin  <myid.shin@samsung.com>
+
+        Web process is crashed during dispatching touchEvent created by JS.
+        https://bugs.webkit.org/show_bug.cgi?id=113225
+
+        Reviewed by Benjamin Poulain.
+
+        TouchEvent created by JS should have the necessary attributes
+        of touches, targetTouches and changedTouches.
+        It should be verified weather there are touchLists before dispatching touch event.
+
+        * fast/events/touch/create-touch-event-without-touchList-expected.txt: Added.
+        * fast/events/touch/create-touch-event-without-touchList.html: Added.
+
 2014-04-25  Radu Stavila  <stavila@adobe.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-04-25  Miyoung Shin  <myid.shin@samsung.com>
+
+        Web process is crashed during dispatching touchEvent created by JS.
+        https://bugs.webkit.org/show_bug.cgi?id=113225
+
+        Reviewed by Benjamin Poulain.
+
+        TouchEvent created by JS should have the necessary attributes
+        of touches, targetTouches and changedTouches.
+        It should be verified weather there are touchLists before dispatching touch event.
+
+        Test: fast/events/touch/create-touch-event-without-touchList.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent):
+        (WebCore::EventPath::updateTouchLists):
+        (WebCore::addRelatedNodeResolversForTouchList): Deleted.
+
 2014-04-25  Philippe Normand  <pnormand@igalia.com>
 

trunk/Source/WebCore/dom/EventDispatcher.cpp

@@ -89 +89 @@
 
 #if ENABLE(TOUCH_EVENTS)
-    void updateTouchLists(const TouchEvent&);
+    bool updateTouchLists(const TouchEvent&);
 #endif
     void setRelatedTarget(Node& origin, EventTarget&);
@@ -340 +340 @@
         eventPath.setRelatedTarget(*node, *relatedTarget);
 #if ENABLE(TOUCH_EVENTS) && !PLATFORM(IOS)
-    if (event->isTouchEvent())
-        eventPath.updateTouchLists(*toTouchEvent(event.get()));
+    if (event->isTouchEvent()) {
+        if (!eventPath.updateTouchLists(*toTouchEvent(event.get())))
+            return true;
+    }
 #endif
 
@@ -460 +462 @@
 }
 
-void EventPath::updateTouchLists(const TouchEvent& touchEvent)
-{
+bool EventPath::updateTouchLists(const TouchEvent& touchEvent)
+{
+    if (!touchEvent.touches() || !touchEvent.targetTouches() || !touchEvent.changedTouches())
+        return false;
+    
     Vector<EventRelatedNodeResolver, 16> touchTargetResolvers;
     const size_t touchNodeCount = touchEvent.touches()->length() + touchEvent.targetTouches()->length() + touchEvent.changedTouches()->length();
@@ -482 +487 @@
         }
     }
+    return true;
 }
 #endif