Fix a crash in IsMenulistInput().

Bug: 938867 Change-Id: I8c146af675d085d0784d5ff7c54670d0f6597c80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1507912Reviewed-by: Keishi Hattori <keishi@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/master@{#638534}

Fix a crash in IsMenulistInput().
Bug: 938867 Change-Id: I8c146af675d085d0784d5ff7c54670d0f6597c80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1507912Reviewed-by: Keishi Hattori <keishi@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/master@{#638534}
0fab4f5f · Kent Tamura · Commit Bot · 2929de50 · 0fab4f5f · 0fab4f5f
Commit 0fab4f5f authored Mar 07, 2019 by Kent Tamura Committed by Commit Bot Mar 07, 2019
2 changed files
--- a/third_party/blink/renderer/core/paint/theme_painter.cc
+++ b/third_party/blink/renderer/core/paint/theme_painter.cc
@@ -70,7 +70,7 @@ bool IsTemporalInput(const AtomicString& type) {
 }

 bool IsMenulistInput(const Node* node) {
-  if (auto* input = ToHTMLInputElement(node)) {
+  if (auto* input = ToHTMLInputElementOrNull(node)) {
 #if defined(OS_ANDROID)
    if (IsTemporalInput(input->type()))
      return true;

--- a/third_party/blink/web_tests/fast/forms/select/appearance-menulist-crash.html
+++ b/third_party/blink/web_tests/fast/forms/select/appearance-menulist-crash.html
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<div style="-webkit-appearance:menulist;"></div>
+<div style="-webkit-appearance:menulist-button;"></div>
+<script>
+test(() => {
+  document.body.offsetBottom;
+}, 'Check if menulist/menulist-button on neither SELECT nor INPUT does not crash');
+</script>
+