Skip to content

GitLab

T
tangled
Commit 4f491f69 authored by keishi@chromium.org's avatar keishi@chromium.org
Browse files
Options

Check if input element is a range control before painting slider ticks 

We weren't checking if the input element is a range control inside paintSliderTicks and so we were hitting an assert.

TEST=Automated. Added slider-appearance-with-ticks-crash.html.
BUG=350905

Review URL: https://codereview.chromium.org/194273004

git-svn-id: svn://svn.chromium.org/blink/trunk@169936 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 30f7d1b5
Hide whitespace changes
Inline Side-by-side
Showing with 21 additions and 0 deletions
third_party/WebKit/LayoutTests/fast/forms/datalist/slider-appearance-with-ticks-crash.html 0 → 100644
View file @ 4f491f69
<!DOCTYPE html>
<html>
<body>
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
<p>No crash means test PASS.</p>
<input type="text" list="foo" style="-webkit-appearance: slider-vertical">
<input type="text" list="foo" style="-webkit-appearance: slider-horizontal">
<datalist id="foo">
<option>1</option>
</datalist>
</body>
</html>
third_party/WebKit/Source/core/rendering/RenderTheme.cpp
View file @ 4f491f69
...@@ -868,6 +868,9 @@ void RenderTheme::paintSliderTicks(RenderObject* o, const PaintInfo& paintInfo, ...@@ -868,6 +868,9 @@ void RenderTheme::paintSliderTicks(RenderObject* o, const PaintInfo& paintInfo,
return; return;
HTMLInputElement* input = toHTMLInputElement(node); HTMLInputElement* input = toHTMLInputElement(node);
if (!input->isRangeControl())
return;
HTMLDataListElement* dataList = input->dataList(); HTMLDataListElement* dataList = input->dataList();
if (!dataList) if (!dataList)
return; return;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment