- Revision
- 124407
- Author
- [email protected]
- Date
- 2012-08-01 21:57:24 -0700 (Wed, 01 Aug 2012)
Log Message
The elements in Shadow DOM of input should not be modifiable.
https://bugs.webkit.org/show_bug.cgi?id=92200
Reviewed by Kent Tamura.
Source/WebCore:
Since we don't have "-webkit-user-modify: read-only !important;" for the elements in Shadow DOM of
input element, user can change them and it causes a crash.
We should have "-webkit-user-modify: read-only !important;" for those elements.
Test: fast/forms/input-user-modify.html
* css/html.css:
(input::-webkit-textfield-decoration-container):
(input[type="search"]::-webkit-search-cancel-button):
(input[type="search"]::-webkit-search-decoration):
(input[type="search"]::-webkit-search-results-decoration):
(input[type="search"]::-webkit-search-results-button):
(input::-webkit-inner-spin-button):
(input::-webkit-input-speech-button):
(input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
(input[type="file"]::-webkit-file-upload-button):
(input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-media-slider-container):
(input[type="range"]::-webkit-slider-runnable-track):
(input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb):
(input[type="color"]::-webkit-color-swatch-wrapper):
(input[type="color"]::-webkit-color-swatch):
(input::-webkit-calendar-picker-indicator):
LayoutTests:
* fast/forms/input-user-modify-expected.txt: Added.
* fast/forms/input-user-modify.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (124406 => 124407)
--- trunk/LayoutTests/ChangeLog 2012-08-02 04:49:25 UTC (rev 124406)
+++ trunk/LayoutTests/ChangeLog 2012-08-02 04:57:24 UTC (rev 124407)
@@ -1,3 +1,13 @@
+2012-08-01 Shinya Kawanaka <[email protected]>
+
+ The elements in Shadow DOM of input should not be modifiable.
+ https://bugs.webkit.org/show_bug.cgi?id=92200
+
+ Reviewed by Kent Tamura.
+
+ * fast/forms/input-user-modify-expected.txt: Added.
+ * fast/forms/input-user-modify.html: Added.
+
2012-08-01 Filip Pizlo <[email protected]>
DFG should hoist structure checks
Added: trunk/LayoutTests/fast/forms/input-user-modify-expected.txt (0 => 124407)
--- trunk/LayoutTests/fast/forms/input-user-modify-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/input-user-modify-expected.txt 2012-08-02 04:57:24 UTC (rev 124407)
@@ -0,0 +1,3 @@
+The inner element of input should not be modifiable. Trying to delete the inner element of input should not cause a crash.
+
+PASS
Added: trunk/LayoutTests/fast/forms/input-user-modify.html (0 => 124407)
--- trunk/LayoutTests/fast/forms/input-user-modify.html (rev 0)
+++ trunk/LayoutTests/fast/forms/input-user-modify.html 2012-08-02 04:57:24 UTC (rev 124407)
@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+input::-webkit-textfield-decoration-container,
+input[type="search"]::-webkit-textfield-decoration-container,
+input[type="search"]::-webkit-search-cancel-button,
+input[type="search"]::-webkit-search-decoration,
+input[type="search"]::-webkit-search-results-decoration,
+input[type="search"]::-webkit-search-results-button,
+::-webkit-input-speech-button,
+::-webkit-input-placeholder,
+input::-webkit-input-placeholder,
+isindex::-webkit-input-placeholder,
+input[type="button"], input[type="submit"], input[type="reset"],
+input[type="file"]::-webkit-file-upload-button,
+button,
+input[type="range"]::-webkit-slider-container,
+input[type="range"]::-webkit-media-slider-container,
+input[type="range"]::-webkit-slider-runnable-track,
+input[type="range"]::-webkit-slider-thumb,
+input[type="range"]::-webkit-color-swatch-wrapper,
+input[type="range"]::-webkit-color-swatch,
+input::-webkit-calendar-picker-indicator {
+ -webkit-user-modify: read-write;
+}
+</style>
+</head>
+<body>
+
+<p>The inner element of input should not be modifiable.
+ Trying to delete the inner element of input should not cause a crash.</p>
+
+<div id="container">
+ <input id="search" type="search">
+ <input id="file" type="file">
+ <input id="range" type="range">
+ <input id="color" type="color">
+ <input id="number" type="number">
+ <input id="placeholder" type="text" placeholder="something">
+ <input id="speech" type="text" x-webkit-speech>
+ <button id="button">something</button>
+ <input id="date" type="date">
+ <video id="video" controls>
+ <audio id="audio" controls>
+</div>
+
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function focusAndType(id, key)
+{
+ if (!window.eventSenver)
+ return;
+
+ var target = document.getElementById(id);
+ eventSender.mouseMoveTo(target.offsetLeft + 2, target.offsetTop + 2);
+ eventSender.mouseDown();
+ eventSender.mouseUp();
+ eventSender.keyDown(key);
+}
+
+var container = document.getElementById("container");
+
+focusAndType("search", "delete");
+focusAndType("file", "delete");
+focusAndType("range", "delete");
+focusAndType("color", "delete");
+focusAndType("number", "delete");
+focusAndType("placeholder", "delete");
+focusAndType("speech", "delete");
+focusAndType("button", "delete");
+focusAndType("date", "delete");
+focusAndType("video", "delete");
+focusAndType("audio", "delete");
+
+if (window.testRunner)
+ container.innerHTML = "PASS";
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (124406 => 124407)
--- trunk/Source/WebCore/ChangeLog 2012-08-02 04:49:25 UTC (rev 124406)
+++ trunk/Source/WebCore/ChangeLog 2012-08-02 04:57:24 UTC (rev 124407)
@@ -1,3 +1,34 @@
+2012-08-01 Shinya Kawanaka <[email protected]>
+
+ The elements in Shadow DOM of input should not be modifiable.
+ https://bugs.webkit.org/show_bug.cgi?id=92200
+
+ Reviewed by Kent Tamura.
+
+ Since we don't have "-webkit-user-modify: read-only !important;" for the elements in Shadow DOM of
+ input element, user can change them and it causes a crash.
+
+ We should have "-webkit-user-modify: read-only !important;" for those elements.
+
+ Test: fast/forms/input-user-modify.html
+
+ * css/html.css:
+ (input::-webkit-textfield-decoration-container):
+ (input[type="search"]::-webkit-search-cancel-button):
+ (input[type="search"]::-webkit-search-decoration):
+ (input[type="search"]::-webkit-search-results-decoration):
+ (input[type="search"]::-webkit-search-results-button):
+ (input::-webkit-inner-spin-button):
+ (input::-webkit-input-speech-button):
+ (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
+ (input[type="file"]::-webkit-file-upload-button):
+ (input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-media-slider-container):
+ (input[type="range"]::-webkit-slider-runnable-track):
+ (input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb):
+ (input[type="color"]::-webkit-color-swatch-wrapper):
+ (input[type="color"]::-webkit-color-swatch):
+ (input::-webkit-calendar-picker-indicator):
+
2012-08-01 Peter Wang <[email protected]>
Web Inspector: [JSC] implement setting breakpoints by line:column
Modified: trunk/Source/WebCore/css/html.css (124406 => 124407)
--- trunk/Source/WebCore/css/html.css 2012-08-02 04:49:25 UTC (rev 124406)
+++ trunk/Source/WebCore/css/html.css 2012-08-02 04:57:24 UTC (rev 124407)
@@ -435,6 +435,7 @@
input::-webkit-textfield-decoration-container {
display: -webkit-box;
-webkit-box-align: center;
+ -webkit-user-modify: read-only !important;
}
input[type="search"]::-webkit-textfield-decoration-container {
@@ -445,24 +446,28 @@
-webkit-appearance: searchfield-cancel-button;
display: block;
-webkit-box-flex: 0;
+ -webkit-user-modify: read-only !important;
}
input[type="search"]::-webkit-search-decoration {
-webkit-appearance: searchfield-decoration;
display: block;
-webkit-box-flex: 0;
+ -webkit-user-modify: read-only !important;
}
input[type="search"]::-webkit-search-results-decoration {
-webkit-appearance: searchfield-results-decoration;
display: block;
-webkit-box-flex: 0;
+ -webkit-user-modify: read-only !important;
}
input[type="search"]::-webkit-search-results-button {
-webkit-appearance: searchfield-results-button;
display: block;
-webkit-box-flex: 0;
+ -webkit-user-modify: read-only !important;
}
#if defined(ENABLE_DATALIST_ELEMENT) && ENABLE_DATALIST_ELEMENT
@@ -548,6 +553,7 @@
vertical-align: top;
-webkit-box-flex: 0;
-webkit-user-select: none;
+ -webkit-user-modify: read-only !important;
}
#if defined(ENABLE_INPUT_SPEECH) && ENABLE_INPUT_SPEECH
@@ -556,6 +562,7 @@
display: block;
vertical-align: top;
-webkit-box-flex: 0;
+ -webkit-user-modify: read-only !important;
}
#endif
@@ -592,6 +599,7 @@
white-space: pre;
word-wrap: normal;
overflow: hidden;
+ -webkit-user-modify: read-only !important;
}
input[type="password"] {
@@ -631,6 +639,7 @@
input[type="file"]::-webkit-file-upload-button {
-webkit-appearance: push-button;
+ -webkit-user-modify: read-only !important;
white-space: nowrap;
margin: 0;
font-size: inherit;
@@ -659,6 +668,7 @@
-webkit-box-align: center;
-webkit-box-orient: horizontal; /* This property is updated by C++ code. */
-webkit-box-sizing: border-box;
+ -webkit-user-modify: read-only !important;
display: -webkit-box;
height: 100%;
width: 100%;
@@ -667,12 +677,14 @@
input[type="range"]::-webkit-slider-runnable-track {
-webkit-box-flex: 1;
-webkit-box-sizing: border-box;
+ -webkit-user-modify: read-only !important;
display: block;
}
input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb {
-webkit-appearance: sliderthumb-horizontal;
-webkit-box-sizing: border-box;
+ -webkit-user-modify: read-only !important;
display: block;
position: relative;
}
@@ -717,6 +729,7 @@
display:-webkit-box;
padding: 4px 2px;
-webkit-box-sizing: border-box;
+ -webkit-user-modify: read-only !important;
width: 100%;
height: 100%
}
@@ -725,6 +738,7 @@
background-color: #000000;
border: 1px solid #777777;
-webkit-box-flex: 1;
+ -webkit-user-modify: read-only !important;
}
#if defined(ENABLE_DATALIST_ELEMENT) && ENABLE_DATALIST_ELEMENT
@@ -753,6 +767,7 @@
width: 0.66em;
height: 0.66em;
padding: 0.17em 0.34em;
+ -webkit-user-modify: read-only !important;
}
input::-webkit-calendar-picker-indicator:hover {
