Title: [207072] releases/WebKitGTK/webkit-2.14
Revision
207072
Author
carlo...@webkit.org
Date
2016-10-11 02:25:14 -0700 (Tue, 11 Oct 2016)

Log Message

Merge r205861 - Input type object and the associated render can go out of sync.
https://bugs.webkit.org/show_bug.cgi?id=161871
<rdar://problem/28178094>

Reviewed by Antti Koivisto.

Source/WebCore:

Bail out when we've got a mismatched renderer.

Test: fast/forms/assert-on-input-type-change.html

* html/ImageInputType.cpp:
(WebCore::ImageInputType::altAttributeChanged):

LayoutTests:

* fast/forms/assert-on-input-type-change-expected.txt: Added.
* fast/forms/assert-on-input-type-change.html: Added.

Modified Paths

Added Paths

Diff

Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog (207071 => 207072)


--- releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog	2016-10-11 09:23:28 UTC (rev 207071)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog	2016-10-11 09:25:14 UTC (rev 207072)
@@ -1,3 +1,14 @@
+2016-09-12  Zalan Bujtas  <za...@apple.com>
+
+        Input type object and the associated render can go out of sync.
+        https://bugs.webkit.org/show_bug.cgi?id=161871
+        <rdar://problem/28178094>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/forms/assert-on-input-type-change-expected.txt: Added.
+        * fast/forms/assert-on-input-type-change.html: Added.
+
 2016-09-10  Chris Dumez  <cdu...@apple.com>
 
         It is possible for Document::m_frame pointer to become stale

Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/forms/assert-on-input-type-change-expected.txt (0 => 207072)


--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/forms/assert-on-input-type-change-expected.txt	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/forms/assert-on-input-type-change-expected.txt	2016-10-11 09:25:14 UTC (rev 207072)
@@ -0,0 +1 @@
+PASS if no assert in debug. 

Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/forms/assert-on-input-type-change.html (0 => 207072)


--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/forms/assert-on-input-type-change.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/forms/assert-on-input-type-change.html	2016-10-11 09:25:14 UTC (rev 207072)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we manage input type change properly.</title>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+function runTest() {
+    var item = document.getElementById("foobar");
+    item.type = 'image';
+    item.alt="foobar";
+}
+</script>
+<body _onload_="runTest();">
+PASS if no assert in debug.
+<input id=foobar type="text">
+</body>
+</html>

Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (207071 => 207072)


--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog	2016-10-11 09:23:28 UTC (rev 207071)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog	2016-10-11 09:25:14 UTC (rev 207072)
@@ -1,3 +1,18 @@
+2016-09-12  Zalan Bujtas  <za...@apple.com>
+
+        Input type object and the associated render can go out of sync.
+        https://bugs.webkit.org/show_bug.cgi?id=161871
+        <rdar://problem/28178094>
+
+        Reviewed by Antti Koivisto.
+
+        Bail out when we've got a mismatched renderer.
+
+        Test: fast/forms/assert-on-input-type-change.html
+
+        * html/ImageInputType.cpp:
+        (WebCore::ImageInputType::altAttributeChanged):
+
 2016-09-22  Zalan Bujtas  <za...@apple.com>
 
         Replace redundant prepareForDestruction() call with RELEASE_ASSERT in Document::removedLastRef.

Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/html/ImageInputType.cpp (207071 => 207072)


--- releases/WebKitGTK/webkit-2.14/Source/WebCore/html/ImageInputType.cpp	2016-10-11 09:23:28 UTC (rev 207071)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/html/ImageInputType.cpp	2016-10-11 09:25:14 UTC (rev 207072)
@@ -109,6 +109,9 @@
 
 void ImageInputType::altAttributeChanged()
 {
+    if (!is<RenderImage>(element().renderer()))
+        return;
+
     auto* renderer = downcast<RenderImage>(element().renderer());
     if (!renderer)
         return;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to