Changeset 76366 in webkit

Timestamp:

Jan 21, 2011 11:20:05 AM (13 years ago)

Author:

Dimitri Glazkov

Message:

2011-01-21 Dimitri Glazkov <Dimitri Glazkov>

Reviewed by Darin Adler.

REGRESSION(r73618): Clicking on a search input causes a crash.
​https://bugs.webkit.org/show_bug.cgi?id=52905

• fast/dom/search-shadow-host-crash-expected.txt: Added.
• fast/dom/search-shadow-host-crash.html: Added.

2011-01-21 Dimitri Glazkov <Dimitri Glazkov>

Reviewed by Darin Adler.

REGRESSION(r73618): Clicking on a search input causes a crash.
​https://bugs.webkit.org/show_bug.cgi?id=52905

The problem is caused by TextControlInnerElement being used both as
shadow root and an element in a shadow subtree. The code assumed it is
only used as a shadow root.

Since this code is all just workaround for in-progress conversion to
new shadow DOM, I am just adding a check. This code will disappear
completely once bug 52788 is fixed.

Test: fast/dom/search-shadow-host-crash.html

• dom/Node.cpp: (WebCore::Node::setShadowHost): Added an ASSERT for early detection

of attempting to stomp on the parentNode.

• rendering/TextControlInnerElements.cpp: (WebCore::TextControlInnerElement::detach): Added a check to only

clear shadow host if we have one.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/search-shadow-host-crash-expected.txt (added)
• LayoutTests/fast/dom/search-shadow-host-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Node.cpp (modified) (1 diff)
• Source/WebCore/rendering/TextControlInnerElements.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-01-21  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r73618): Clicking on a search input causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=52905
+
+        * fast/dom/search-shadow-host-crash-expected.txt: Added.
+        * fast/dom/search-shadow-host-crash.html: Added.
+
 2011-01-21  Dimitri Glazkov  <dglazkov@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-01-21  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r73618): Clicking on a search input causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=52905
+
+        The problem is caused by TextControlInnerElement being used both as
+        shadow root and an element in a shadow subtree. The code assumed it is
+        only used as a shadow root.
+
+        Since this code is all just workaround for in-progress conversion to
+        new shadow DOM, I am just adding a check. This code will disappear
+        completely once bug 52788 is fixed.
+
+        Test: fast/dom/search-shadow-host-crash.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::setShadowHost): Added an ASSERT for early detection
+            of attempting to stomp on the parentNode.
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::detach): Added a check to only
+            clear shadow host if we have one.
+
 2011-01-21  Adam Roben  <aroben@apple.com>
 

trunk/Source/WebCore/dom/Node.cpp

@@ -493 +493 @@
 void Node::setShadowHost(Element* host)
 {
+    ASSERT(!parentNode());
     if (host)
         setFlag(IsShadowRootFlag);

trunk/Source/WebCore/rendering/TextControlInnerElements.cpp

@@ -120 +120 @@
     HTMLDivElement::detach();
     // FIXME: Remove once shadow DOM uses Element::setShadowRoot().
-    setShadowHost(0);
+    if (shadowHost())
+        setShadowHost(0);
 }