Changeset 57081 in webkit

Timestamp:

Apr 5, 2010 10:27:18 AM (14 years ago)

Author:

Dimitri Glazkov

Message:

2010-04-05 Dimitri Glazkov <Dimitri Glazkov>

Reviewed by Darin Adler.

Style update done due to mutation event dispatching in textarea can be
used to corrupt the render tree.
​https://bugs.webkit.org/show_bug.cgi?id=36864

Modified listbox-selection.html to correctly set the size during
creation. Otherwise, options added to it as a menuList, resulting
in a default selection of the first item.

Added a few more tests to ensure we capture correct behavior for
select elements and their default selection, as well as the influence
of when layout occurs.

• fast/forms/listbox-selection.html:
• fast/forms/select-change-listbox-to-popup-roundtrip.html: Added.
• fast/forms/select-change-popup-to-listbox-roundtrip.html: Added.
• fast/forms/textarea-and-mutation-events.html: Added.

2010-04-05 Dimitri Glazkov <Dimitri Glazkov>

Reviewed by Darin Adler.

Style update done due to mutation event dispatching in textarea can be
used to corrupt the render tree.
​https://bugs.webkit.org/show_bug.cgi?id=36864

Tests: fast/forms/select-change-listbox-to-popup-roundtrip.html

fast/forms/select-change-popup-to-listbox-roundtrip.html
fast/forms/textarea-and-mutation-events.html

• dom/Node.cpp: (WebCore::Node::dispatchGenericEvent): Removed invocation of

Document::updateStyleForAllDocuments

• html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::parseMappedAttribute): Added explicit

recalc to ensure accuracy of representation, especially for
menuList/listBox switches.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/listbox-selection.html (modified) (1 diff)
• LayoutTests/fast/forms/select-change-listbox-to-popup-roundtrip-expected.txt (added)
• LayoutTests/fast/forms/select-change-listbox-to-popup-roundtrip.html (added)
• LayoutTests/fast/forms/select-change-popup-to-listbox-roundtrip-expected.txt (added)
• LayoutTests/fast/forms/select-change-popup-to-listbox-roundtrip.html (added)
• LayoutTests/fast/forms/textarea-and-mutation-events-expected.txt (added)
• LayoutTests/fast/forms/textarea-and-mutation-events.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/Node.cpp (modified) (1 diff)
• WebCore/html/HTMLSelectElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-04-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Style update done due to mutation event dispatching in textarea can be
+        used to corrupt the render tree.
+        https://bugs.webkit.org/show_bug.cgi?id=36864
+
+        Modified listbox-selection.html to correctly set the size during
+        creation. Otherwise, options added to it as a menuList, resulting
+        in a default selection of the first item.
+
+        Added a few more tests to ensure we capture correct behavior for
+        select elements and their default selection, as well as the influence
+        of when layout occurs.
+
+        * fast/forms/listbox-selection.html:
+        * fast/forms/select-change-listbox-to-popup-roundtrip.html: Added.
+        * fast/forms/select-change-popup-to-listbox-roundtrip.html: Added.
+        * fast/forms/textarea-and-mutation-events.html: Added.
+
 2010-04-05  Yury Semikhatsky  <yurys@chromium.org>
 

trunk/LayoutTests/fast/forms/listbox-selection.html

@@ -151 +151 @@
                 var sl = document.createElement("select");
                 var i = 0;
+                sl.size = sz;
                 while (i < sz) {
                     var opt = document.createElement("option");
                     if (i == selIndex)
                         opt.selected = true;
-                    opt.innerText = "item " + i;
+                    opt.textContent = "item " + i;
                     sl.appendChild(opt);
                     i++;
                 }
-                sl.size = sz;
                 sl.multiple = mlt;
                 sl.id = idName;

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-04-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Style update done due to mutation event dispatching in textarea can be
+        used to corrupt the render tree.
+        https://bugs.webkit.org/show_bug.cgi?id=36864
+
+        Tests: fast/forms/select-change-listbox-to-popup-roundtrip.html
+               fast/forms/select-change-popup-to-listbox-roundtrip.html
+               fast/forms/textarea-and-mutation-events.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent): Removed invocation of
+            Document::updateStyleForAllDocuments
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute): Added explicit
+            recalc to ensure accuracy of representation, especially for
+            menuList/listBox switches.
+
 2010-04-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 

trunk/WebCore/dom/Node.cpp

@@ -2706 +2706 @@
 #endif
 
-    Document::updateStyleForAllDocuments();
-
     return !event->defaultPrevented();
 }

trunk/WebCore/html/HTMLSelectElement.cpp

@@ -201 +201 @@
         if (attrSize != attr->value())
             attr->setValue(attrSize);
-
-        m_data.setSize(max(size, 1));
+        size = max(size, 1);
+
+        // Ensure that we've determined selectedness of the items at least once prior to changing the size.
+        if (oldSize != size)
+            recalcListItemsIfNeeded();
+
+        m_data.setSize(size);
         if ((oldUsesMenuList != m_data.usesMenuList() || (!oldUsesMenuList && m_data.size() != oldSize)) && attached()) {
             detach();