Title: [130717] trunk
- Revision
- 130717
- Author
- [email protected]
- Date
- 2012-10-08 21:47:07 -0700 (Mon, 08 Oct 2012)
Log Message
HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
https://bugs.webkit.org/show_bug.cgi?id=98710
Reviewed by Kent Tamura.
Source/WebCore:
This patch gets rid of C/C++ implementation dependent behavior from
HTMLSelectElement::typeAheadFind() which does modulo operation with
a negative operand.
HTMLSelectElement::typeAheadFind() contains _expression_ with modulo
operator and dividend can be -1 when the "select" element without
"option" element but "optgroup" element.
Test: fast/forms/select/select-typeahead-crash.html
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::typeAheadFind): Changed to do modulo
operation with both operands are non-negative.
LayoutTests:
This patch adds a test for checking HTMLSelectElement::typeAheadFind
doesn't crash.
* fast/forms/select/select-typeahead-crash-expected.txt: Added.
* fast/forms/select/select-typeahead-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (130716 => 130717)
--- trunk/LayoutTests/ChangeLog 2012-10-09 02:18:20 UTC (rev 130716)
+++ trunk/LayoutTests/ChangeLog 2012-10-09 04:47:07 UTC (rev 130717)
@@ -1,3 +1,16 @@
+2012-10-08 Yoshifumi Inoue <[email protected]>
+
+ HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
+ https://bugs.webkit.org/show_bug.cgi?id=98710
+
+ Reviewed by Kent Tamura.
+
+ This patch adds a test for checking HTMLSelectElement::typeAheadFind
+ doesn't crash.
+
+ * fast/forms/select/select-typeahead-crash-expected.txt: Added.
+ * fast/forms/select/select-typeahead-crash.html: Added.
+
2012-10-08 Kent Tamura <[email protected]>
Take account of overflowing values for width calculation of a year sub-field
Added: trunk/LayoutTests/fast/forms/select/select-typeahead-crash-expected.txt (0 => 130717)
--- trunk/LayoutTests/fast/forms/select/select-typeahead-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/select/select-typeahead-crash-expected.txt 2012-10-09 04:47:07 UTC (rev 130717)
@@ -0,0 +1,12 @@
+Select element without option but optgroup causes crash on key press
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Please run this with DumpRenderTree.
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/forms/select/select-typeahead-crash-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/forms/select/select-typeahead-crash.html (0 => 130717)
--- trunk/LayoutTests/fast/forms/select/select-typeahead-crash.html (rev 0)
+++ trunk/LayoutTests/fast/forms/select/select-typeahead-crash.html 2012-10-09 04:47:07 UTC (rev 130717)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<p>Please run this with DumpRenderTree.</p>
+<select id="test"><optgroup></optgroup><optgroup></optgroup></select>
+<div id="console"></div>
+<script>
+description('Select element without option but optgroup causes crash on key press');
+function keyDown(key, modifiers)
+{
+ if (!window.eventSender)
+ return;
+ eventSender.keyDown(key, modifiers);
+}
+var test = document.getElementById("test");
+test.focus();
+keyDown('a');
+keyDown('b');
+</script>
+<script src=""
+</body>
Property changes on: trunk/LayoutTests/fast/forms/select/select-typeahead-crash.html
___________________________________________________________________
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (130716 => 130717)
--- trunk/Source/WebCore/ChangeLog 2012-10-09 02:18:20 UTC (rev 130716)
+++ trunk/Source/WebCore/ChangeLog 2012-10-09 04:47:07 UTC (rev 130717)
@@ -1,3 +1,24 @@
+2012-10-08 Yoshifumi Inoue <[email protected]>
+
+ HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
+ https://bugs.webkit.org/show_bug.cgi?id=98710
+
+ Reviewed by Kent Tamura.
+
+ This patch gets rid of C/C++ implementation dependent behavior from
+ HTMLSelectElement::typeAheadFind() which does modulo operation with
+ a negative operand.
+
+ HTMLSelectElement::typeAheadFind() contains _expression_ with modulo
+ operator and dividend can be -1 when the "select" element without
+ "option" element but "optgroup" element.
+
+ Test: fast/forms/select/select-typeahead-crash.html
+
+ * html/HTMLSelectElement.cpp:
+ (WebCore::HTMLSelectElement::typeAheadFind): Changed to do modulo
+ operation with both operands are non-negative.
+
2012-10-08 Kent Tamura <[email protected]>
Take account of overflowing values for width calculation of a year sub-field
Modified: trunk/Source/WebCore/html/HTMLSelectElement.cpp (130716 => 130717)
--- trunk/Source/WebCore/html/HTMLSelectElement.cpp 2012-10-09 02:18:20 UTC (rev 130716)
+++ trunk/Source/WebCore/html/HTMLSelectElement.cpp 2012-10-09 04:47:07 UTC (rev 130717)
@@ -1514,8 +1514,10 @@
return;
int selected = selectedIndex();
- int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
- ASSERT(index >= 0);
+ int index = optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset;
+ if (index < 0)
+ return;
+ index %= itemCount;
// Compute a case-folded copy of the prefix string before beginning the search for
// a matching element. This code uses foldCase to work around the fact that
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
