Changeset 57116 in webkit


Ignore:
Timestamp:
Apr 5, 2010 8:08:45 PM (14 years ago)
Author:
jamesr@google.com
Message:

2010-04-05 Dimitri Glazkov <Dimitri Glazkov> and James Robinson <​jamesr@chromium.org>

Reviewed by Darin Adler and Dimitri Glazkov.

Style update done due to mutation event dispatching in textarea can be
used to corrupt the render tree.
​https://bugs.webkit.org/show_bug.cgi?id=36864

Tests: fast/forms/select-change-listbox-to-popup-roundtrip.html

fast/forms/select-change-popup-to-listbox-roundtrip.html
fast/forms/textarea-and-mutation-events.html

  • dom/Document.cpp: (WebCore::Document::finishedParsing): Added updateStyleIfNeeded()

call to ensure that object loads start before firing window load.

  • dom/Node.cpp: (WebCore::Node::dispatchGenericEvent): Removed invocation of

Document::updateStyleForAllDocuments

  • html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::parseMappedAttribute): Added explicit

recalc to ensure accuracy of representation, especially for
menuList/listBox switches.

2010-04-05 Dimitri Glazkov <Dimitri Glazkov>

Reviewed by Darin Adler

Style update done due to mutation event dispatching in textarea can be
used to corrupt the render tree.
​https://bugs.webkit.org/show_bug.cgi?id=36864

Modified listbox-selection.html to correctly set the size during
creation. Otherwise, options added to it as a menuList, resulting
in a default selection of the first item.

Added a few more tests to ensure we capture correct behavior for
select elements and their default selection, as well as the influence
of when layout occurs.

  • fast/forms/listbox-selection.html:
  • fast/forms/select-change-listbox-to-popup-roundtrip.html: Added.
  • fast/forms/select-change-popup-to-listbox-roundtrip.html: Added.
  • fast/forms/textarea-and-mutation-events.html: Added.
Location:
trunk
Files:
6 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r57113 r57116  
     12010-04-05  Dimitri Glazkov  <dglazkov@chromium.org>
     2
     3        Reviewed by Darin Adler
     4
     5        Style update done due to mutation event dispatching in textarea can be
     6        used to corrupt the render tree.
     7        https://bugs.webkit.org/show_bug.cgi?id=36864
     8
     9        Modified listbox-selection.html to correctly set the size during
     10        creation. Otherwise, options added to it as a menuList, resulting
     11        in a default selection of the first item.
     12
     13        Added a few more tests to ensure we capture correct behavior for
     14        select elements and their default selection, as well as the influence
     15        of when layout occurs.
     16
     17        * fast/forms/listbox-selection.html:
     18        * fast/forms/select-change-listbox-to-popup-roundtrip.html: Added.
     19        * fast/forms/select-change-popup-to-listbox-roundtrip.html: Added.
     20        * fast/forms/textarea-and-mutation-events.html: Added.
     21
    1222010-04-05  Mark Rowe  <mrowe@apple.com>
    223

  • trunk/LayoutTests/fast/forms/listbox-selection.html

    r57100 r57116  
    151151                var sl = document.createElement("select");
    152152                var i = 0;
     153                sl.size = sz;
    153154                while (i < sz) {
    154155                    var opt = document.createElement("option");
    155156                    if (i == selIndex)
    156157                        opt.selected = true;
    157                     opt.innerText = "item " + i;
     158                    opt.textContent = "item " + i;
    158159                    sl.appendChild(opt);
    159160                    i++;
    160161                }
    161                 sl.size = sz;
    162162                sl.multiple = mlt;
    163163                sl.id = idName;

  • trunk/WebCore/ChangeLog

    r57112 r57116  
     12010-04-05  Dimitri Glazkov  <dglazkov@chromium.org> and James Robinson <jamesr@chromium.org>
     2
     3        Reviewed by Darin Adler and Dimitri Glazkov.
     4
     5        Style update done due to mutation event dispatching in textarea can be
     6        used to corrupt the render tree.
     7        https://bugs.webkit.org/show_bug.cgi?id=36864
     8
     9        Tests: fast/forms/select-change-listbox-to-popup-roundtrip.html
     10               fast/forms/select-change-popup-to-listbox-roundtrip.html
     11               fast/forms/textarea-and-mutation-events.html
     12
     13        * dom/Document.cpp:
     14        (WebCore::Document::finishedParsing): Added updateStyleIfNeeded()
     15            call to ensure that object loads start before firing window load.
     16        * dom/Node.cpp:
     17        (WebCore::Node::dispatchGenericEvent): Removed invocation of
     18            Document::updateStyleForAllDocuments
     19        * html/HTMLSelectElement.cpp:
     20        (WebCore::HTMLSelectElement::parseMappedAttribute): Added explicit
     21            recalc to ensure accuracy of representation, especially for
     22            menuList/listBox switches.
     23
    1242010-04-05  Antonio Gomes  <tonikitoo@webkit.org>
    225

  • trunk/WebCore/dom/Document.cpp

    r57045 r57116  
    41904190    setParsing(false);
    41914191    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false));
     4192
    41924193    if (Frame* f = frame()) {
     4194        // FrameLoader::finishedParsing() might end up calling Document::implicitClose() if all
     4195        // resource loads are complete. HTMLObjectElements can start loading their resources from
     4196        // post attach callbacks triggered by recalcStyle().  This means if we parse out an <object>
     4197        // tag and then reach the end of the document without updating styles, we might not have yet
     4198        // started the resource load and might fire the window load event too early.  To avoid this
     4199        // we force the styles to be up to date before calling FrameLoader::finishedParsing().
     4200        // See https://bugs.webkit.org/show_bug.cgi?id=36864 starting around comment 35.
     4201        updateStyleIfNeeded();
     4202
    41934203        f->loader()->finishedParsing();
    41944204

  • trunk/WebCore/dom/Node.cpp

    r57100 r57116  
    27062706#endif
    27072707
    2708     Document::updateStyleForAllDocuments();
    2709 
    27102708    return !event->defaultPrevented();
    27112709}

  • trunk/WebCore/html/HTMLSelectElement.cpp

    r57100 r57116  
    201201        if (attrSize != attr->value())
    202202            attr->setValue(attrSize);
    203 
    204         m_data.setSize(max(size, 1));
     203        size = max(size, 1);
     204
     205        // Ensure that we've determined selectedness of the items at least once prior to changing the size.
     206        if (oldSize != size)
     207            recalcListItemsIfNeeded();
     208
     209        m_data.setSize(size);
    205210        if ((oldUsesMenuList != m_data.usesMenuList() || (!oldUsesMenuList && m_data.size() != oldSize)) && attached()) {
    206211            detach();
Note: See TracChangeset for help on using the changeset viewer.