Changeset 60984 in webkit

Timestamp:

Jun 10, 2010 5:49:10 PM (14 years ago)

Author:

tony@chromium.org

Message:

2010-06-10 Tony Chang <​tony@chromium.org>

Reviewed by Kent Tamura.

crash when focus is changed while trying to focus next element
​https://bugs.webkit.org/show_bug.cgi?id=40407

• fast/events/focus-change-crash-expected.txt: Added.
• fast/events/focus-change-crash.html: Added.

2010-06-10 Tony Chang <​tony@chromium.org>

Reviewed by Kent Tamura.

crash when focus is changed while trying to focus next element
​https://bugs.webkit.org/show_bug.cgi?id=40407

Test: fast/events/focus-change-crash.html

• dom/Element.cpp: (WebCore::Element::focus):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/focus-change-crash-expected.txt (added)
• LayoutTests/fast/events/focus-change-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/Element.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-06-10  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        crash when focus is changed while trying to focus next element
+        https://bugs.webkit.org/show_bug.cgi?id=40407
+
+        * fast/events/focus-change-crash-expected.txt: Added.
+        * fast/events/focus-change-crash.html: Added.
+
 2010-06-10  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-06-10  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        crash when focus is changed while trying to focus next element
+        https://bugs.webkit.org/show_bug.cgi?id=40407
+
+        Test: fast/events/focus-change-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+
 2010-06-10  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/dom/Element.cpp

@@ -1322 +1322 @@
     }
 
-    if (Page* page = doc->page())
+    RefPtr<Node> protect;
+    if (Page* page = doc->page()) {
+        // Focus and change event handlers can cause us to lose our last ref.
+        protect = this;
         page->focusController()->setFocusedNode(this, doc->frame());
+    }
 
     // Setting the focused node above might have invalidated the layout due to scripts.