Title: [105776] branches/chromium/963
- Revision
- 105776
- Author
- [email protected]
- Date
- 2012-01-24 12:40:43 -0800 (Tue, 24 Jan 2012)
Log Message
Merge 105212 - Crash in in WebCore::EventHandler::mouseMoved.
BUG=110374
Review URL: https://chromiumcodereview.appspot.com/9160033
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt (from rev 105212, trunk/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt) (0 => 105776)
--- branches/chromium/963/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt 2012-01-24 20:40:43 UTC (rev 105776)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/963/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html (from rev 105212, trunk/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html) (0 => 105776)
--- branches/chromium/963/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html 2012-01-24 20:40:43 UTC (rev 105776)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function onMouseMove()
+{
+ document.body.innerHTML = "PASS";
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+function runTest()
+{
+ root = document.getElementById('root').contentDocument;
+ root.addEventListener('mousemove', onMouseMove, 0);
+ eventSender.mouseMoveTo(1, 1);
+ eventSender.mouseMoveTo(0, 0);
+}
+</script>
+<style>body { margin: 0px; }</style>
+<object data="" id="root" _onload_="runTest()"></object>
+</html>
Copied: branches/chromium/963/LayoutTests/fast/events/resources/mouse-move.html (from rev 105212, trunk/LayoutTests/fast/events/resources/mouse-move.html) (0 => 105776)
--- branches/chromium/963/LayoutTests/fast/events/resources/mouse-move.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/events/resources/mouse-move.html 2012-01-24 20:40:43 UTC (rev 105776)
@@ -0,0 +1,2 @@
+<div id="test"></div><iframe src=""
+
Modified: branches/chromium/963/Source/WebCore/page/EventHandler.cpp (105775 => 105776)
--- branches/chromium/963/Source/WebCore/page/EventHandler.cpp 2012-01-24 20:32:37 UTC (rev 105775)
+++ branches/chromium/963/Source/WebCore/page/EventHandler.cpp 2012-01-24 20:40:43 UTC (rev 105776)
@@ -1556,6 +1556,8 @@
bool EventHandler::mouseMoved(const PlatformMouseEvent& event, bool onlyUpdateScrollbars)
{
+ RefPtr<FrameView> protector(m_frame->view());
+
HitTestResult hoveredNode = HitTestResult(LayoutPoint());
bool result = handleMouseMoveEvent(event, &hoveredNode, onlyUpdateScrollbars);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
