Skip to content

GitLab

T
tangled
Commit e5b83af1 authored by chrishtr's avatar chrishtr Committed by Commit bot
Browse files
Options

Protect against lifecycle updates that delete a layout object for autoscroll. 

NOPRESUBMIT=true
BUG=713190

Review-Url: https://codereview.chromium.org/2844593002
Cr-Commit-Position: refs/heads/master@{#468109}
parent 39206f00
Hide whitespace changes
Inline Side-by-side
Showing with 50 additions and 6 deletions
third_party/WebKit/LayoutTests/fast/events/autoscroll-select-crash.html 0 → 100644
View file @ e5b83af1
<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<iframe id=iframe srcdoc="
<style>
.c:hover { display: block; }
.c { content: attr(class); width: 400px; height: 400px; }
</style>
<body id=body>
<select id=target autofocus=autofocus size=2 class=c></select>
</body>"></iframe>
<script>
var testObj;
function moveGesture() {
eventSender.mouseMoveTo(200, 51);
eventSender.mouseUp();
testObj.done();
}
function reloadIframe() {
iframe.contentWindow.location.reload();
setTimeout(moveGesture, 50);
}
function go(test) {
testObj = test;
if (window.eventSender) {
eventSender.mouseMoveTo(200, 50);
eventSender.mouseDown();
setTimeout(reloadIframe, 0);
} else {
test.done();
}
}
async_test(go);
</script>
third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
View file @ e5b83af1
......@@ -1518,9 +1518,13 @@ void HTMLSelectElement::ListBoxDefaultEventHandler(Event* event) {
!mouse_event->ButtonDown())
return;
if (Page* page = GetDocument().GetPage())
if (LayoutObject* object = GetLayoutObject())
object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
if (Page* page = GetDocument().GetPage()) {
page->GetAutoscrollController().StartAutoscrollForSelection(
GetLayoutObject());
}
// Mousedown didn't happen in this element.
if (last_on_change_selection_.IsEmpty())
return;
......
third_party/WebKit/Source/core/input/MouseEventManager.cpp
View file @ e5b83af1
......@@ -738,7 +738,7 @@ WebInputEventResult MouseEventManager::HandleMouseDraggedEvent(
event, mouse_down_pos_, drag_start_pos_, mouse_press_node_.Get(),
last_known_mouse_position_);
// The call into handleMouseDraggedEvent may have caused a re-layout,
// The call into HandleMouseDraggedEvent may have caused a re-layout,
// so get the LayoutObject again.
layout_object = target_node->GetLayoutObject();
......@@ -747,8 +747,15 @@ WebInputEventResult MouseEventManager::HandleMouseDraggedEvent(
!frame_->Selection().SelectedHTMLForClipboard().IsEmpty()) {
if (AutoscrollController* controller =
scroll_manager_->GetAutoscrollController()) {
controller->StartAutoscrollForSelection(layout_object);
mouse_down_may_start_autoscroll_ = false;
// Avoid updating the lifecycle unless it's possible to autoscroll.
layout_object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
// The lifecycle update above may have invalidated the previous layout.
layout_object = target_node->GetLayoutObject();
if (layout_object) {
controller->StartAutoscrollForSelection(layout_object);
mouse_down_may_start_autoscroll_ = false;
}
}
}
......
third_party/WebKit/Source/core/page/AutoscrollController.cpp
View file @ e5b83af1
......@@ -76,8 +76,6 @@ void AutoscrollController::StartAutoscrollForSelection(
// it's already active.
if (autoscroll_type_ != kNoAutoscroll)
return;
if (layout_object)
layout_object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
LayoutBox* scrollable = LayoutBox::FindAutoscrollable(layout_object);
if (!scrollable)
scrollable =
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment