Skip to content

GitLab

T
tangled
Commit ac2cc3d1 authored by inferno@chromium.org's avatar inferno@chromium.org
Browse files
Options

Crash in FocusController::advanceFocusInDocumentOrder 

https://bugs.webkit.org/show_bug.cgi?id=66678

Source/WebCore: 

RefPtr the focusable node to prevent getting deleted by mutation
event.

Reviewed by Dave Hyatt.

Test: fast/frames/focus-controller-crash-change-event.html

* page/FocusController.cpp:
(WebCore::FocusController::advanceFocusInDocumentOrder):

LayoutTests: 

Reviewed by Dave Hyatt.

* fast/frames/focus-controller-crash-change-event-expected.txt: Added.
* fast/frames/focus-controller-crash-change-event.html: Added.


git-svn-id: svn://svn.chromium.org/blink/trunk@93514 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 8c13d985
Hide whitespace changes
Inline Side-by-side
Showing with 63 additions and 5 deletions
third_party/WebKit/LayoutTests/ChangeLog
View file @ ac2cc3d1
2011-08-22 Abhishek Arya <inferno@chromium.org>
Crash in FocusController::advanceFocusInDocumentOrder
https://bugs.webkit.org/show_bug.cgi?id=66678
Reviewed by Dave Hyatt.
* fast/frames/focus-controller-crash-change-event-expected.txt: Added.
* fast/frames/focus-controller-crash-change-event.html: Added.
2011-08-22 Martin Robinson <mrobinson@igalia.com> 2011-08-22 Martin Robinson <mrobinson@igalia.com>
[GTK] Some GTK+-specific font-face tests fail on the bots [GTK] Some GTK+-specific font-face tests fail on the bots
third_party/WebKit/LayoutTests/fast/frames/focus-controller-crash-change-event.html 0 → 100644
View file @ ac2cc3d1
<html>
<div id="b">
Press a key!
<input id="a">
<iframe></iframe>
</div>
<script>
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
a.addEventListener("change", function() {
b.innerHTML = "PASS";
if (window.layoutTestController)
layoutTestController.notifyDone();
});
a.addEventListener("keyup", function() {
var e = document.createEvent("KeyboardEvent");
e.initKeyboardEvent('keydown', true, true, document.defaultView, 'U+0009', 0, false, false, false, false, false);
a.dispatchEvent(e);
})
document.body.offsetTop;
a.focus();
if (window.layoutTestController)
eventSender.keyDown('a');
</script>
</html>
\ No newline at end of file
third_party/WebKit/Source/WebCore/ChangeLog
View file @ ac2cc3d1
2011-08-22 Abhishek Arya <inferno@chromium.org>
Crash in FocusController::advanceFocusInDocumentOrder
https://bugs.webkit.org/show_bug.cgi?id=66678
RefPtr the focusable node to prevent getting deleted by mutation
event.
Reviewed by Dave Hyatt.
Test: fast/frames/focus-controller-crash-change-event.html
* page/FocusController.cpp:
(WebCore::FocusController::advanceFocusInDocumentOrder):
2011-08-22 Justin Novosad <junov@chromium.org> 2011-08-22 Justin Novosad <junov@chromium.org>
[Chromium] Crash when allocation of very large canvas fails [Chromium] Crash when allocation of very large canvas fails
third_party/WebKit/Source/WebCore/page/FocusController.cpp
View file @ ac2cc3d1
...@@ -246,7 +246,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb ...@@ -246,7 +246,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
document->updateLayoutIgnorePendingStylesheets(); document->updateLayoutIgnorePendingStylesheets();
Node* node = findFocusableNodeAcrossTreeScope(direction, currentNode ? currentNode->treeScope() : document, currentNode, event); RefPtr<Node> node = findFocusableNodeAcrossTreeScope(direction, currentNode ? currentNode->treeScope() : document, currentNode, event);
if (!node) { if (!node) {
// We didn't find a node to focus, so we should try to pass focus to Chrome. // We didn't find a node to focus, so we should try to pass focus to Chrome.
...@@ -259,7 +259,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb ...@@ -259,7 +259,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
// Chrome doesn't want focus, so we should wrap focus. // Chrome doesn't want focus, so we should wrap focus.
node = findFocusableNode(direction, m_page->mainFrame()->document(), 0, event); node = findFocusableNode(direction, m_page->mainFrame()->document(), 0, event);
node = findFocusableNodeDecendingDownIntoFrameDocumentOrShadowRoot(direction, node, event); node = findFocusableNodeDecendingDownIntoFrameDocumentOrShadowRoot(direction, node.get(), event);
if (!node) if (!node)
return false; return false;
...@@ -278,7 +278,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb ...@@ -278,7 +278,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
if (node->isFrameOwnerElement()) { if (node->isFrameOwnerElement()) {
// We focus frames rather than frame owners. // We focus frames rather than frame owners.
// FIXME: We should not focus frames that have no scrollbars, as focusing them isn't useful to the user. // FIXME: We should not focus frames that have no scrollbars, as focusing them isn't useful to the user.
HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(node); HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(node.get());
if (!owner->contentFrame()) if (!owner->contentFrame())
return false; return false;
...@@ -301,13 +301,13 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb ...@@ -301,13 +301,13 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
setFocusedFrame(newDocument->frame()); setFocusedFrame(newDocument->frame());
if (caretBrowsing) { if (caretBrowsing) {
Position position = firstPositionInOrBeforeNode(node); Position position = firstPositionInOrBeforeNode(node.get());
VisibleSelection newSelection(position, position, DOWNSTREAM); VisibleSelection newSelection(position, position, DOWNSTREAM);
if (frame->selection()->shouldChangeSelection(newSelection)) if (frame->selection()->shouldChangeSelection(newSelection))
frame->selection()->setSelection(newSelection); frame->selection()->setSelection(newSelection);
} }
static_cast<Element*>(node)->focus(false); static_cast<Element*>(node.get())->focus(false);
return true; return true;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment