Skip to content

GitLab

T
tangled
Commit fa5be439 authored by rniwa@webkit.org's avatar rniwa@webkit.org
Browse files
Options

2011-02-09 Ryosuke Niwa <rniwa@webkit.org> 

        Reviewed by Darin Adler.

        REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
        https://bugs.webkit.org/show_bug.cgi?id=54053

        The bug was caused by RenderBlock::positionForPoint's improperly returning a shadow node inside
        RenderFileUploadControl for hit testing and VisibleSelection::toNormalizedRange's always assuming
        the position variable "s" is not null.

        Fixed the bug by always returning a null position from RenderFileUploadControl::positionForPoint,
        and also exiting early when either "s" or "e" is null in VisibleSelection::toNormalizedRange.

        Test: fast/forms/file-input-hit-test.html

        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::toNormalizedRange):
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::positionForPoint):
        * rendering/RenderFileUploadControl.h:
2011-02-09  Ryosuke Niwa  <rniwa@webkit.org>

        Reviewed by Darin Adler.

        REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
        https://bugs.webkit.org/show_bug.cgi?id=54053

        Added a test to ensure WebKit does not crash when a user clicks on a region immediately after a file
        upload control.

        * fast/forms/file-input-hit-test-expected.txt: Added.
        * fast/forms/file-input-hit-test.html: Added.


git-svn-id: svn://svn.chromium.org/blink/trunk@78168 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 6a18a04a
Hide whitespace changes
Inline Side-by-side
Showing with 74 additions and 1 deletion
third_party/WebKit/LayoutTests/ChangeLog
View file @ fa5be439
2011-02-09 Ryosuke Niwa <rniwa@webkit.org>
Reviewed by Darin Adler.
REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
https://bugs.webkit.org/show_bug.cgi?id=54053
Added a test to ensure WebKit does not crash when a user clicks on a region immediately after a file
upload control.
* fast/forms/file-input-hit-test-expected.txt: Added.
* fast/forms/file-input-hit-test.html: Added.
2011-02-09 Zhenyao Mo <zmo@google.com> 2011-02-09 Zhenyao Mo <zmo@google.com>
Unreviewed, test expectations update. Unreviewed, test expectations update.
third_party/WebKit/LayoutTests/fast/forms/file-input-hit-test-expected.txt 0 → 100644
View file @ fa5be439
This tests clicking on a region immediately after a file input field. WebKit should not crash and you should see PASS below. To manually test this, click on the black region below.
PASS
third_party/WebKit/LayoutTests/fast/forms/file-input-hit-test.html 0 → 100644
View file @ fa5be439
<!DOCTYPE htlm>
<html>
<body>
<p>This tests clicking on a region immediately after a file input field. WebKit should not crash and you should see PASS below.
To manually test this, click on the black region below.</p>
<div id="form" style="width: 200px; height: 200px; position: absolute; top: 20px; left: 0px; background: black;">
<input type="file" style="width: 100px; height: 50px; display: block; padding: 10px; background: white;">
</div>
<script>
if (window.layoutTestController && window.eventSender) {
layoutTestController.dumpAsText();
eventSender.mouseMoveTo(180, 50);
eventSender.leapForward(200);
eventSender.mouseDown();
eventSender.leapForward(200);
eventSender.mouseUp();
eventSender.leapForward(200);
document.writeln('PASS');
}
</script>
</body>
</html>
third_party/WebKit/Source/WebCore/ChangeLog
View file @ fa5be439
2011-02-09 Ryosuke Niwa <rniwa@webkit.org>
Reviewed by Darin Adler.
REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
https://bugs.webkit.org/show_bug.cgi?id=54053
The bug was caused by RenderBlock::positionForPoint's improperly returning a shadow node inside
RenderFileUploadControl for hit testing and VisibleSelection::toNormalizedRange's always assuming
the position variable "s" is not null.
Fixed the bug by always returning a null position from RenderFileUploadControl::positionForPoint,
and also exiting early when either "s" or "e" is null in VisibleSelection::toNormalizedRange.
Test: fast/forms/file-input-hit-test.html
* editing/VisibleSelection.cpp:
(WebCore::VisibleSelection::toNormalizedRange):
* rendering/RenderFileUploadControl.cpp:
(WebCore::RenderFileUploadControl::positionForPoint):
* rendering/RenderFileUploadControl.h:
2011-02-09 Sam Weinig <sam@webkit.org> 2011-02-09 Sam Weinig <sam@webkit.org>
Reviewed by Beth Dakin. Reviewed by Beth Dakin.
third_party/WebKit/Source/WebCore/editing/VisibleSelection.cpp
View file @ fa5be439
...@@ -172,6 +172,9 @@ PassRefPtr<Range> VisibleSelection::toNormalizedRange() const ...@@ -172,6 +172,9 @@ PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
s = s.parentAnchoredEquivalent(); s = s.parentAnchoredEquivalent();
e = e.parentAnchoredEquivalent(); e = e.parentAnchoredEquivalent();
} }
if (s.isNull() || e.isNull())
return 0;
// VisibleSelections are supposed to always be valid. This constructor will ASSERT // VisibleSelections are supposed to always be valid. This constructor will ASSERT
// if a valid range could not be created, which is fine for this callsite. // if a valid range could not be created, which is fine for this callsite.
......
third_party/WebKit/Source/WebCore/rendering/RenderFileUploadControl.cpp
View file @ fa5be439
...@@ -297,6 +297,11 @@ void RenderFileUploadControl::computePreferredLogicalWidths() ...@@ -297,6 +297,11 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
setPreferredLogicalWidthsDirty(false); setPreferredLogicalWidthsDirty(false);
} }
VisiblePosition RenderFileUploadControl::positionForPoint(const IntPoint&)
{
return VisiblePosition();
}
void RenderFileUploadControl::receiveDroppedFiles(const Vector<String>& paths) void RenderFileUploadControl::receiveDroppedFiles(const Vector<String>& paths)
{ {
if (allowsMultipleFiles()) if (allowsMultipleFiles())
......
third_party/WebKit/Source/WebCore/rendering/RenderFileUploadControl.h
View file @ fa5be439
...@@ -28,7 +28,7 @@ namespace WebCore { ...@@ -28,7 +28,7 @@ namespace WebCore {
class Chrome; class Chrome;
class HTMLInputElement; class HTMLInputElement;
// Each RenderFileUploadControl contains a RenderButton (for opening the file chooser), and // Each RenderFileUploadControl contains a RenderButton (for opening the file chooser), and
// sufficient space to draw a file icon and filename. The RenderButton has a shadow node // sufficient space to draw a file icon and filename. The RenderButton has a shadow node
// associated with it to receive click/hover events. // associated with it to receive click/hover events.
...@@ -71,6 +71,8 @@ private: ...@@ -71,6 +71,8 @@ private:
Chrome* chrome() const; Chrome* chrome() const;
int maxFilenameWidth() const; int maxFilenameWidth() const;
PassRefPtr<RenderStyle> createButtonStyle(const RenderStyle* parentStyle) const; PassRefPtr<RenderStyle> createButtonStyle(const RenderStyle* parentStyle) const;
virtual VisiblePosition positionForPoint(const IntPoint&);
RefPtr<HTMLInputElement> m_button; RefPtr<HTMLInputElement> m_button;
RefPtr<FileChooser> m_fileChooser; RefPtr<FileChooser> m_fileChooser;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment