Changeset 40804 in webkit

Timestamp:

Feb 9, 2009 7:13:06 PM (15 years ago)

Author:

mrowe@apple.com

Message:

Fix <​https://bugs.webkit.org/show_bug.cgi?id=23858>
Bug 23858: Crash when removing a HTMLSelectElement from the document from inside its focus event handler

Reviewed by Darin Adler.

• html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::menuListDefaultEventHandler): Don't store the renderer in a local variable
as it can be invalidated by any of the calls to focus() within the function. Instead, retrieve it and
null-check it when it is needed.

Test for <​https://bugs.webkit.org/show_bug.cgi?id=23858>
Bug 23858: Crash when removing a HTMLSelectElement from the document from inside its focus event handler

Reviewed by Sam Weinig.

• fast/dom/HTMLSelectElement/remove-element-from-within-focus-handler-crash-expected.txt: Added.
• fast/dom/HTMLSelectElement/remove-element-from-within-focus-handler-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/HTMLSelectElement/remove-element-from-within-focus-handler-crash-expected.txt (added)
• LayoutTests/fast/dom/HTMLSelectElement/remove-element-from-within-focus-handler-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLSelectElement.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Test for <https://bugs.webkit.org/show_bug.cgi?id=23858>
+        Bug 23858: Crash when removing a HTMLSelectElement from the document from inside its focus event handler
+
+        * fast/dom/HTMLSelectElement/remove-element-from-within-focus-handler-crash-expected.txt: Added.
+        * fast/dom/HTMLSelectElement/remove-element-from-within-focus-handler-crash.html: Added.
+
 2009-02-09  Dimitri Glazkov  <dglazkov@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=23858>
+        Bug 23858: Crash when removing a HTMLSelectElement from the document from inside its focus event handler
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler): Don't store the renderer in a local variable
+        as it can be invalidated by any of the calls to focus() within the function.  Instead, retrieve it and
+        null-check it when it is needed.
+
 2009-02-09  David Hyatt  <hyatt@apple.com>
 

trunk/WebCore/html/HTMLSelectElement.cpp

@@ -618 +618 @@
 void HTMLSelectElement::menuListDefaultEventHandler(Event* evt)
 {
-    RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer());
-
     if (evt->type() == eventNames().keydownEvent) {
         if (!renderer() || !evt->isKeyboardEvent())
@@ -631 +629 @@
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection();
-            menuList->showPopup();
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer()))
+                menuList->showPopup();
             handled = true;
         }
@@ -673 +672 @@
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection();
-            menuList->showPopup();
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer()))
+                menuList->showPopup();
             handled = true;
         }
@@ -696 +696 @@
     if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
         focus();
-        if (menuList->popupIsVisible())
-            menuList->hidePopup();
-        else {
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
+        if (RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer())) {
+            if (menuList->popupIsVisible())
+                menuList->hidePopup();
+            else {
+                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                saveLastSelection();
+                menuList->showPopup();
+            }
         }
         evt->setDefaultHandled();