[webkit-changes] [101337] trunk

Tue, 29 Nov 2011 00:13:29 -0800

Title: [101337] trunk
Revision
101337
Author
[email protected]
Date
2011-11-29 00:13:02 -0800 (Tue, 29 Nov 2011)

Log Message

Assertion fails when opening two popup menus
https://bugs.webkit.org/show_bug.cgi?id=73189

Patch by Jing Zhao <[email protected]> on 2011-11-29
Reviewed by Kent Tamura.

By using element.dispatchEvent(), a user written script can open two
popup menus, which causes the assertion in WebViewImpl::popupOpened()
fail.

Check if there is an opened popup menu before opening a popup menu.

Source/WebKit/chromium:

* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::popupOpened):

LayoutTests:

* fast/forms/select-popup-crash-expected.txt: Added.
* fast/forms/select-popup-crash.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (101336 => 101337)


--- trunk/LayoutTests/ChangeLog	2011-11-29 08:10:30 UTC (rev 101336)
+++ trunk/LayoutTests/ChangeLog	2011-11-29 08:13:02 UTC (rev 101337)
@@ -1,3 +1,19 @@
+2011-11-29  Jing Zhao  <[email protected]>
+
+        Assertion fails when opening two popup menus
+        https://bugs.webkit.org/show_bug.cgi?id=73189
+
+        Reviewed by Kent Tamura.
+
+        By using element.dispatchEvent(), a user written script can open two
+        popup menus, which causes the assertion in WebViewImpl::popupOpened()
+        fail.
+
+        Check if there is an opened popup menu before opening a popup menu.
+
+        * fast/forms/select-popup-crash-expected.txt: Added.
+        * fast/forms/select-popup-crash.html: Added.
+
 2011-11-29  Alexandru Chiculita  <[email protected]>
 
         [CSS Filters] Filters do not render correctly when the layer has a transform

Added: trunk/LayoutTests/fast/forms/select-popup-crash-expected.txt (0 => 101337)


--- trunk/LayoutTests/fast/forms/select-popup-crash-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/forms/select-popup-crash-expected.txt	2011-11-29 08:13:02 UTC (rev 101337)
@@ -0,0 +1,5 @@
+<select> test for opening two popup menus.
+
+PASS if the test didn't crash.
+
+

Added: trunk/LayoutTests/fast/forms/select-popup-crash.html (0 => 101337)


--- trunk/LayoutTests/fast/forms/select-popup-crash.html	                        (rev 0)
+++ trunk/LayoutTests/fast/forms/select-popup-crash.html	2011-11-29 08:13:02 UTC (rev 101337)
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+</head>
+<body>
+<p id="description">&lt;select> test for opening two popup menus.</p>
+<div id="console"></div>
+<p id="debug">PASS if the test didn't crash.</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var parent = document.createElement('div');
+    parent.innerHTML = '<select id="sl1">'
+        + '<option>one</option>'
+        + '<option>two</option>'
+        + '<option>three</option>'
+        + '<option>four</option>'
+        + '<option>five</option>'
+        + '<option>six</option>'
+        + '<option>seven</option>'
+        + '<option>eight</option>'
+        + '<option>nine</option>'
+        + '<option>ten</option>'
+        + '<option>eleven</option>'
+        + '<option>twelve</option>'
+        + '<option>thirteen</option>'
+        + '<option>fourteen</option>'
+        + '<option>fifteen</option>'
+        + '<option>sixteen</option>'
+        + '<option>seventeen</option>'
+        + '</select>'
+        + '<select id="sl2">'
+        + '<option>one</option>'
+        + '<option>two</option>'
+        + '<option>three</option>'
+        + '</select>';
+    document.body.appendChild(parent);
+
+    function mouseDownOnSelect(selId)
+    {
+        var sl = document.getElementById(selId);
+        var event = document.createEvent("MouseEvent");
+        event.initMouseEvent("mousedown", true, true, document.defaultView, 1, sl.offsetLeft, sl.offsetTop, sl.offsetLeft, sl.offsetTop, false, false, false, false, 0, document);
+        sl.dispatchEvent(event);
+    }
+
+    mouseDownOnSelect("sl1");
+    mouseDownOnSelect("sl2");
+
+</script>
+</body>
+</html>

Modified: trunk/Source/WebKit/chromium/ChangeLog (101336 => 101337)


--- trunk/Source/WebKit/chromium/ChangeLog	2011-11-29 08:10:30 UTC (rev 101336)
+++ trunk/Source/WebKit/chromium/ChangeLog	2011-11-29 08:13:02 UTC (rev 101337)
@@ -1,3 +1,19 @@
+2011-11-29  Jing Zhao  <[email protected]>
+
+        Assertion fails when opening two popup menus
+        https://bugs.webkit.org/show_bug.cgi?id=73189
+
+        Reviewed by Kent Tamura.
+
+        By using element.dispatchEvent(), a user written script can open two
+        popup menus, which causes the assertion in WebViewImpl::popupOpened()
+        fail.
+
+        Check if there is an opened popup menu before opening a popup menu.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::popupOpened):
+
 2011-11-28  David Grogan  <[email protected]>
 
         WebWorkerRunLoop wrapper around WorkerRunLoop

Modified: trunk/Source/WebKit/chromium/src/WebViewImpl.cpp (101336 => 101337)


--- trunk/Source/WebKit/chromium/src/WebViewImpl.cpp	2011-11-29 08:10:30 UTC (rev 101336)
+++ trunk/Source/WebKit/chromium/src/WebViewImpl.cpp	2011-11-29 08:13:02 UTC (rev 101337)
@@ -966,8 +966,8 @@
 void  WebViewImpl::popupOpened(WebCore::PopupContainer* popupContainer)
 {
     if (popupContainer->popupType() == WebCore::PopupContainer::Select) {
-        ASSERT(!m_selectPopup);
-        m_selectPopup = popupContainer;
+        if (!m_selectPopup)
+            m_selectPopup = popupContainer;
     }
 }
 

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to