Skip to content

GitLab

T
tangled
Commit fa5be439 authored by rniwa@webkit.org's avatar rniwa@webkit.org
Browse files
Options

2011-02-09 Ryosuke Niwa <rniwa@webkit.org> 

        Reviewed by Darin Adler.

        REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
        https://bugs.webkit.org/show_bug.cgi?id=54053

        The bug was caused by RenderBlock::positionForPoint's improperly returning a shadow node inside
        RenderFileUploadControl for hit testing and VisibleSelection::toNormalizedRange's always assuming
        the position variable "s" is not null.

        Fixed the bug by always returning a null position from RenderFileUploadControl::positionForPoint,
        and also exiting early when either "s" or "e" is null in VisibleSelection::toNormalizedRange.

        Test: fast/forms/file-input-hit-test.html

        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::toNormalizedRange):
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::positionForPoint):
        * rendering/RenderFileUploadControl.h:
2011-02-09  Ryosuke Niwa  <rniwa@webkit.org>

        Reviewed by Darin Adler.

        REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
        https://bugs.webkit.org/show_bug.cgi?id=54053

        Added a test to ensure WebKit does not crash when a user clicks on a region immediately after a file
        upload control.

        * fast/forms/file-input-hit-test-expected.txt: Added.
        * fast/forms/file-input-hit-test.html: Added.


git-svn-id: svn://svn.chromium.org/blink/trunk@78168 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 6a18a04a
Show whitespace changes
Inline Side-by-side
Showing with 74 additions and 1 deletion
third_party/WebKit/LayoutTests/ChangeLog
View file @ fa5be439
2011-02-09 Ryosuke Niwa <rniwa@webkit.org>
Reviewed by Darin Adler.
REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
https://bugs.webkit.org/show_bug.cgi?id=54053
Added a test to ensure WebKit does not crash when a user clicks on a region immediately after a file
upload control.
* fast/forms/file-input-hit-test-expected.txt: Added.
* fast/forms/file-input-hit-test.html: Added.
2011-02-09 Zhenyao Mo <zmo@google.com>
Unreviewed, test expectations update.
third_party/WebKit/LayoutTests/fast/forms/file-input-hit-test-expected.txt 0 → 100644
View file @ fa5be439
This tests clicking on a region immediately after a file input field. WebKit should not crash and you should see PASS below. To manually test this, click on the black region below.
PASS
third_party/WebKit/LayoutTests/fast/forms/file-input-hit-test.html 0 → 100644
View file @ fa5be439
<!DOCTYPE htlm>
<html>
<body>
<p>This tests clicking on a region immediately after a file input field. WebKit should not crash and you should see PASS below.
To manually test this, click on the black region below.</p>
<div id="form" style="width: 200px; height: 200px; position: absolute; top: 20px; left: 0px; background: black;">
<input type="file" style="width: 100px; height: 50px; display: block; padding: 10px; background: white;">
</div>
<script>
if (window.layoutTestController && window.eventSender) {
layoutTestController.dumpAsText();
eventSender.mouseMoveTo(180, 50);
eventSender.leapForward(200);
eventSender.mouseDown();
eventSender.leapForward(200);
eventSender.mouseUp();
eventSender.leapForward(200);
document.writeln('PASS');
}
</script>
</body>
</html>
third_party/WebKit/Source/WebCore/ChangeLog
View file @ fa5be439
2011-02-09 Ryosuke Niwa <rniwa@webkit.org>
Reviewed by Darin Adler.
REGRESSION(r76107): Crash in VisibleSelection::toNormalizedRange
https://bugs.webkit.org/show_bug.cgi?id=54053
The bug was caused by RenderBlock::positionForPoint's improperly returning a shadow node inside
RenderFileUploadControl for hit testing and VisibleSelection::toNormalizedRange's always assuming
the position variable "s" is not null.
Fixed the bug by always returning a null position from RenderFileUploadControl::positionForPoint,
and also exiting early when either "s" or "e" is null in VisibleSelection::toNormalizedRange.
Test: fast/forms/file-input-hit-test.html
* editing/VisibleSelection.cpp:
(WebCore::VisibleSelection::toNormalizedRange):
* rendering/RenderFileUploadControl.cpp:
(WebCore::RenderFileUploadControl::positionForPoint):
* rendering/RenderFileUploadControl.h:
2011-02-09 Sam Weinig <sam@webkit.org>
Reviewed by Beth Dakin.
third_party/WebKit/Source/WebCore/editing/VisibleSelection.cpp
View file @ fa5be439
......@@ -173,6 +173,9 @@ PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
e = e.parentAnchoredEquivalent();
}
if (s.isNull() || e.isNull())
return 0;
// VisibleSelections are supposed to always be valid. This constructor will ASSERT
// if a valid range could not be created, which is fine for this callsite.
return Range::create(s.node()->document(), s, e);
......
third_party/WebKit/Source/WebCore/rendering/RenderFileUploadControl.cpp
View file @ fa5be439
......@@ -297,6 +297,11 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
setPreferredLogicalWidthsDirty(false);
}
VisiblePosition RenderFileUploadControl::positionForPoint(const IntPoint&)
{
return VisiblePosition();
}
void RenderFileUploadControl::receiveDroppedFiles(const Vector<String>& paths)
{
if (allowsMultipleFiles())
......
third_party/WebKit/Source/WebCore/rendering/RenderFileUploadControl.h
View file @ fa5be439
......@@ -72,6 +72,8 @@ private:
int maxFilenameWidth() const;
PassRefPtr<RenderStyle> createButtonStyle(const RenderStyle* parentStyle) const;
virtual VisiblePosition positionForPoint(const IntPoint&);
RefPtr<HTMLInputElement> m_button;
RefPtr<FileChooser> m_fileChooser;
};
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment