Changeset 73634 in webkit

Timestamp:

Dec 9, 2010 11:36:44 AM (13 years ago)

Author:

yael.aharon@nokia.com

Message:

2010-12-09 Yael Aharon <​yael.aharon@nokia.com>

Reviewed by Antonio Gomes.

Spatial Navigation: Crash when handling iframe of size 0.
​https://bugs.webkit.org/show_bug.cgi?id=50730

• fast/spatial-navigation/snav-hidden-iframe-zero-size-expected.txt: Added.
• fast/spatial-navigation/snav-hidden-iframe-zero-size.html: Added.

2010-12-09 Yael Aharon <​yael.aharon@nokia.com>

Reviewed by Antonio Gomes.

Spatial Navigation: Crash when handling iframe of size 0.
​https://bugs.webkit.org/show_bug.cgi?id=50730

if we have a frame of size 0, we would get into infinite loop and eventually crash. The reason is
that when the algorithm sees a starting rect of size 0, it assumes that there is no focused node,
thus restarts itself. The solution is to avoid considering iframes with size 0 for the spatial
navigation algorithm.

Test: fast/spatial-navigation/snav-hidden-iframe-zero-size.html

• page/FocusController.cpp: (WebCore::updateFocusCandidateIfNeeded):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/spatial-navigation/snav-hidden-iframe-zero-size-expected.txt (added)
• LayoutTests/fast/spatial-navigation/snav-hidden-iframe-zero-size.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/page/FocusController.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-12-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Spatial Navigation: Crash when handling iframe of size 0.
+        https://bugs.webkit.org/show_bug.cgi?id=50730
+
+        * fast/spatial-navigation/snav-hidden-iframe-zero-size-expected.txt: Added.
+        * fast/spatial-navigation/snav-hidden-iframe-zero-size.html: Added.
+
 2010-12-09  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-12-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Spatial Navigation: Crash when handling iframe of size 0.
+        https://bugs.webkit.org/show_bug.cgi?id=50730
+
+        if we have a frame of size 0, we would get into infinite loop and eventually crash. The reason is
+        that when the algorithm sees a starting rect of size 0, it assumes that there is no focused node,
+        thus restarts itself. The solution is to avoid considering iframes with size 0 for the spatial
+        navigation algorithm.
+
+        Test: fast/spatial-navigation/snav-hidden-iframe-zero-size.html
+
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfNeeded):
+
 2010-12-09  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/page/FocusController.cpp

@@ -421 +421 @@
 
     // Ignore iframes that don't have a src attribute
-    if (candidate.visibleNode->isFrameOwnerElement() && !static_cast<HTMLFrameOwnerElement*>(candidate.visibleNode)->contentFrame())
+    if (candidate.visibleNode->isFrameOwnerElement() && (!static_cast<HTMLFrameOwnerElement*>(candidate.visibleNode)->contentFrame() || candidate.rect.isEmpty()))
         return;