Changeset 73276 in webkit

Timestamp:

Dec 3, 2010 11:18:09 AM (13 years ago)

Author:

tony@chromium.org

Message:

2010-12-03 Daniel Cheng <​dcheng@chromium.org>

Reviewed by Tony Chang.

Dragging and dropping into an empty document crashes WebKit.
​https://bugs.webkit.org/show_bug.cgi?id=48793

Remove the assert and update callers to check for a null return value.

Test: manual-tests/drop-in-empty-doc.html

• manual-tests/drop-in-empty-doc.html: Added.
• manual-tests/resources/drop-in-empty-doc.xhtml: Added.
• page/DragController.cpp: (WebCore::elementUnderMouse): (WebCore::DragController::tryDocumentDrag): (WebCore::DragController::concludeEditDrag):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• manual-tests/drop-in-empty-doc.html (added)
• manual-tests/resources/drop-in-empty-doc.xhtml (added)
• page/DragController.cpp (modified) (4 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-12-03  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Dragging and dropping into an empty document crashes WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=48793
+
+        Remove the assert and update callers to check for a null return value.
+
+        Test: manual-tests/drop-in-empty-doc.html
+
+        * manual-tests/drop-in-empty-doc.html: Added.
+        * manual-tests/resources/drop-in-empty-doc.xhtml: Added.
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
 2010-12-03  Patrick Gansterer  <paroga@webkit.org>
 

trunk/WebCore/page/DragController.cpp

@@ -269 +269 @@
 }
 
+// This can return null if an empty document is loaded.
 static Element* elementUnderMouse(Document* documentUnderMouse, const IntPoint& p)
 {
@@ -285 +286 @@
         n = n->shadowAncestorNode();
 
-    ASSERT(n);
     return static_cast<Element*>(n);
 }
@@ -328 +328 @@
         IntPoint point = frameView->windowToContents(dragData->clientPosition());
         Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
+        if (!element)
+            return false;
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
@@ -387 +389 @@
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
     Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
+    if (!element)
+        return false;
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);