Title: [107324] branches/chromium/963
- Revision
- 107324
- Author
- [email protected]
- Date
- 2012-02-09 17:24:14 -0800 (Thu, 09 Feb 2012)
Log Message
Merge 106771
BUG=112735
Review URL: https://chromiumcodereview.appspot.com/9369055
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/forms/form-submission-create-crash-expected.txt (from rev 106771, trunk/LayoutTests/fast/forms/form-submission-create-crash-expected.txt) (0 => 107324)
--- branches/chromium/963/LayoutTests/fast/forms/form-submission-create-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/forms/form-submission-create-crash-expected.txt 2012-02-10 01:24:14 UTC (rev 107324)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/963/LayoutTests/fast/forms/form-submission-create-crash.xhtml (from rev 106771, trunk/LayoutTests/fast/forms/form-submission-create-crash.xhtml) (0 => 107324)
--- branches/chromium/963/LayoutTests/fast/forms/form-submission-create-crash.xhtml (rev 0)
+++ branches/chromium/963/LayoutTests/fast/forms/form-submission-create-crash.xhtml 2012-02-10 01:24:14 UTC (rev 107324)
@@ -0,0 +1,25 @@
+<html xmlns='http://www.w3.org/1999/xhtml'>
+Test passes if it does not crash.
+<form>
+<input id="submit" type="submit" />
+</form>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+textNode = document.createTextNode("x");
+document.getElementById("submit").appendChild(textNode);
+
+runTest = function() {
+ event = document.createEvent("MouseEvent");
+ event.initEvent("click");
+ textNode.dispatchEvent(event);
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+setTimeout(runTest, 0);
+</script>
+</html>
Modified: branches/chromium/963/Source/WebCore/loader/FormSubmission.cpp (107323 => 107324)
--- branches/chromium/963/Source/WebCore/loader/FormSubmission.cpp 2012-02-10 01:24:07 UTC (rev 107323)
+++ branches/chromium/963/Source/WebCore/loader/FormSubmission.cpp 2012-02-10 01:24:14 UTC (rev 107324)
@@ -142,8 +142,11 @@
ASSERT(form);
HTMLFormControlElement* submitButton = 0;
- if (event && event->target() && event->target()->toNode())
- submitButton = static_cast<HTMLFormControlElement*>(event->target()->toNode());
+ if (event && event->target()) {
+ Node* node = event->target()->toNode();
+ if (node && node->isElementNode() && toElement(node)->isFormControlElement())
+ submitButton = static_cast<HTMLFormControlElement*>(node);
+ }
FormSubmission::Attributes copiedAttributes;
copiedAttributes.copyFrom(attributes);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
