[webkit-changes] [123704] trunk

Wed, 25 Jul 2012 20:10:20 -0700

Title: [123704] trunk
Revision
123704
Author
[email protected]
Date
2012-07-25 20:10:09 -0700 (Wed, 25 Jul 2012)

Log Message

The elements in ShadowDOM of meter or progress should not be modifiable.
https://bugs.webkit.org/show_bug.cgi?id=92199

Reviewed by Hajime Morita.

Source/WebCore:

A user can set -webkit-user-modify: read-write to the elements in Shadow DOM in a meter or progress element.
This might cause a undesired crash like Bug 65738. They should be unmodifiable.

We add default css values to elements in ShadowDOM of meter or progress to prohibit editing them.

Tests: fast/html/meter-user-modify.html
       fast/html/progress-user-modify.html

* css/html.css:
Added -webkit-user-modify: read-only !important; for these elements so that they won't be
changed by a user.
(meter::-webkit-meter-bar):
(meter::-webkit-meter-optimum-value):
(meter::-webkit-meter-suboptimum-value):
(meter::-webkit-meter-even-less-good-value):
(progress::-webkit-progress-bar):
(progress::-webkit-progress-value):

LayoutTests:

* fast/html/meter-user-modify.html: Added.
* fast/html/meter-user-modify-expected.txt: Added.
* fast/html/progress-user-modify.html: Added.
* fast/html/progress-user-modify-expected.txt: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (123703 => 123704)


--- trunk/LayoutTests/ChangeLog	2012-07-26 03:02:20 UTC (rev 123703)
+++ trunk/LayoutTests/ChangeLog	2012-07-26 03:10:09 UTC (rev 123704)
@@ -1,3 +1,15 @@
+2012-07-25  Shinya Kawanaka  <[email protected]>
+
+        The elements in ShadowDOM of meter or progress should not be modifiable.
+        https://bugs.webkit.org/show_bug.cgi?id=92199
+
+        Reviewed by Hajime Morita.
+
+        * fast/html/meter-user-modify.html: Added.
+        * fast/html/meter-user-modify-expected.txt: Added.
+        * fast/html/progress-user-modify.html: Added.
+        * fast/html/progress-user-modify-expected.txt: Added.
+
 2012-07-25  Xingnan Wang  <[email protected]>
 
         IndexedDB: IDBTransaction::abort() should throw DOMException

Added: trunk/LayoutTests/fast/html/meter-user-modify-expected.txt (0 => 123704)


--- trunk/LayoutTests/fast/html/meter-user-modify-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/html/meter-user-modify-expected.txt	2012-07-26 03:10:09 UTC (rev 123704)
@@ -0,0 +1,7 @@
+PASS renderTreeAfterType is renderTreeBeforeType
+PASS successfullyParsed is true
+
+TEST COMPLETE
+The inner element of meter should not be deleteable.
+
+(before)(after)

Added: trunk/LayoutTests/fast/html/meter-user-modify.html (0 => 123704)


--- trunk/LayoutTests/fast/html/meter-user-modify.html	                        (rev 0)
+++ trunk/LayoutTests/fast/html/meter-user-modify.html	2012-07-26 03:10:09 UTC (rev 123704)
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+meter::-webkit-meter-bar {
+    -webkit-user-modify: read-write;
+}
+
+meter {
+    -webkit-appearance: none;
+}
+</style>
+</head>
+<body>
+<script src=""
+
+<p>The inner element of meter should not be deleteable.</p>
+
+<div id="container" contenteditable>
+    (before)<meter id="meter" min="0" max="100" value="50"></meter>(after)
+</div>
+
+<script>
+function focusAndType(id, key)
+{
+    var target = document.getElementById(id);
+    eventSender.mouseMoveTo(target.offsetLeft + 2, target.offsetTop + 2);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+    eventSender.keyDown(key);
+}
+
+var container = document.getElementById("container");
+renderTreeBeforeType = internals.elementRenderTreeAsText(document.documentElement);
+
+focusAndType("meter", "X");
+
+renderTreeAfterType = internals.elementRenderTreeAsText(document.documentElement);
+shouldBe("renderTreeAfterType", "renderTreeBeforeType");
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/fast/html/progress-user-modify-expected.txt (0 => 123704)


--- trunk/LayoutTests/fast/html/progress-user-modify-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/html/progress-user-modify-expected.txt	2012-07-26 03:10:09 UTC (rev 123704)
@@ -0,0 +1,7 @@
+PASS renderTreeAfterType is renderTreeBeforeType
+PASS successfullyParsed is true
+
+TEST COMPLETE
+The inner element of progress should not be deleteable.
+
+(before)(after)

Added: trunk/LayoutTests/fast/html/progress-user-modify.html (0 => 123704)


--- trunk/LayoutTests/fast/html/progress-user-modify.html	                        (rev 0)
+++ trunk/LayoutTests/fast/html/progress-user-modify.html	2012-07-26 03:10:09 UTC (rev 123704)
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+progress::-webkit-progress-bar, progress::-webkit-progress-value {
+    -webkit-user-modify: read-write;
+}
+
+progress {
+    -webkit-appearance: none;
+}
+</style>
+</head>
+<body>
+<script src=""
+
+<p>The inner element of progress should not be deleteable.</p>
+
+<div id="container" contenteditable>
+    (before)<progress id="progress" min="0" max="100" value="50"></progress>(after)
+</div>
+
+<script>
+function focusAndType(id, key)
+{
+    var target = document.getElementById(id);
+    eventSender.mouseMoveTo(target.offsetLeft + 2, target.offsetTop + 2);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+    eventSender.keyDown(key);
+}
+
+var container = document.getElementById("container");
+renderTreeBeforeType = internals.elementRenderTreeAsText(document.documentElement);
+
+focusAndType("progress", "X");
+
+renderTreeAfterType = internals.elementRenderTreeAsText(document.documentElement);
+shouldBe("renderTreeAfterType", "renderTreeBeforeType");
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>

Modified: trunk/Source/WebCore/ChangeLog (123703 => 123704)


--- trunk/Source/WebCore/ChangeLog	2012-07-26 03:02:20 UTC (rev 123703)
+++ trunk/Source/WebCore/ChangeLog	2012-07-26 03:10:09 UTC (rev 123704)
@@ -1,3 +1,28 @@
+2012-07-25  Shinya Kawanaka  <[email protected]>
+
+        The elements in ShadowDOM of meter or progress should not be modifiable.
+        https://bugs.webkit.org/show_bug.cgi?id=92199
+
+        Reviewed by Hajime Morita.
+
+        A user can set -webkit-user-modify: read-write to the elements in Shadow DOM in a meter or progress element.
+        This might cause a undesired crash like Bug 65738. They should be unmodifiable.
+
+        We add default css values to elements in ShadowDOM of meter or progress to prohibit editing them.
+
+        Tests: fast/html/meter-user-modify.html
+               fast/html/progress-user-modify.html
+
+        * css/html.css:
+        Added -webkit-user-modify: read-only !important; for these elements so that they won't be
+        changed by a user.
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimum-value):
+        (meter::-webkit-meter-even-less-good-value):
+        (progress::-webkit-progress-bar):
+        (progress::-webkit-progress-value):
+
 2012-07-25  Joshua Netterfield  <[email protected]>
 
         [BlackBerry] GraphicsContext3D::paintToCanvas should not swap 0th and 2nd components of color

Modified: trunk/Source/WebCore/css/html.css (123703 => 123704)


--- trunk/Source/WebCore/css/html.css	2012-07-26 03:02:20 UTC (rev 123703)
+++ trunk/Source/WebCore/css/html.css	2012-07-26 03:10:09 UTC (rev 123704)
@@ -819,24 +819,28 @@
     background: -webkit-gradient(linear, left top, left bottom, from(#ddd), to(#ddd), color-stop(0.20, #eee), color-stop(0.45, #ccc), color-stop(0.55, #ccc));
     height: 100%;
     width: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
 meter::-webkit-meter-optimum-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#ad7), to(#ad7), color-stop(0.20, #cea), color-stop(0.45, #7a3), color-stop(0.55, #7a3));
     height: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
 meter::-webkit-meter-suboptimum-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#fe7), to(#fe7), color-stop(0.20, #ffc), color-stop(0.45, #db3), color-stop(0.55, #db3));
     height: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
 meter::-webkit-meter-even-less-good-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#f77), to(#f77), color-stop(0.20, #fcc), color-stop(0.45, #d44), color-stop(0.55, #d44));
     height: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 #endif
@@ -857,6 +861,7 @@
     background-color: gray;
     height: 100%;
     width: 100%;
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 
@@ -864,6 +869,7 @@
     background-color: green;
     height: 100%;
     width: 50%; /* should be removed later */
+    -webkit-user-modify: read-only !important;
     -webkit-box-sizing: border-box;
 }
 #endif

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to