Title: [107322] branches/chromium/1025
- Revision
- 107322
- Author
- [email protected]
- Date
- 2012-02-09 17:23:12 -0800 (Thu, 09 Feb 2012)
Log Message
Merge 106771
BUG=112735
Review URL: https://chromiumcodereview.appspot.com/9369053
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/forms/form-submission-create-crash-expected.txt (from rev 106771, trunk/LayoutTests/fast/forms/form-submission-create-crash-expected.txt) (0 => 107322)
--- branches/chromium/1025/LayoutTests/fast/forms/form-submission-create-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/forms/form-submission-create-crash-expected.txt 2012-02-10 01:23:12 UTC (rev 107322)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/1025/LayoutTests/fast/forms/form-submission-create-crash.xhtml (from rev 106771, trunk/LayoutTests/fast/forms/form-submission-create-crash.xhtml) (0 => 107322)
--- branches/chromium/1025/LayoutTests/fast/forms/form-submission-create-crash.xhtml (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/forms/form-submission-create-crash.xhtml 2012-02-10 01:23:12 UTC (rev 107322)
@@ -0,0 +1,25 @@
+<html xmlns='http://www.w3.org/1999/xhtml'>
+Test passes if it does not crash.
+<form>
+<input id="submit" type="submit" />
+</form>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+textNode = document.createTextNode("x");
+document.getElementById("submit").appendChild(textNode);
+
+runTest = function() {
+ event = document.createEvent("MouseEvent");
+ event.initEvent("click");
+ textNode.dispatchEvent(event);
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+setTimeout(runTest, 0);
+</script>
+</html>
Modified: branches/chromium/1025/Source/WebCore/loader/FormSubmission.cpp (107321 => 107322)
--- branches/chromium/1025/Source/WebCore/loader/FormSubmission.cpp 2012-02-10 01:18:53 UTC (rev 107321)
+++ branches/chromium/1025/Source/WebCore/loader/FormSubmission.cpp 2012-02-10 01:23:12 UTC (rev 107322)
@@ -142,8 +142,11 @@
ASSERT(form);
HTMLFormControlElement* submitButton = 0;
- if (event && event->target() && event->target()->toNode())
- submitButton = static_cast<HTMLFormControlElement*>(event->target()->toNode());
+ if (event && event->target()) {
+ Node* node = event->target()->toNode();
+ if (node && node->isElementNode() && toElement(node)->isFormControlElement())
+ submitButton = static_cast<HTMLFormControlElement*>(node);
+ }
FormSubmission::Attributes copiedAttributes;
copiedAttributes.copyFrom(attributes);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
