Title: [132451] trunk
- Revision
- 132451
- Author
- [email protected]
- Date
- 2012-10-24 23:42:27 -0700 (Wed, 24 Oct 2012)
Log Message
REGRESSION(r132291): Crash in BaseMultipleFieldsDateAndTimeInputType
https://bugs.webkit.org/show_bug.cgi?id=100326
Reviewed by Eric Seidel.
Source/WebCore:
Test: fast/forms/time-multiple-fields/time-multiple-fields-change-type.html
* html/BaseMultipleFieldsDateAndTimeInputType.cpp:
(WebCore::BaseMultipleFieldsDateAndTimeInputType::destroyShadowSubtree):
We need to disconnect m_spinButtonElement before destructing the UA shadow tree.
LayoutTests:
* fast/forms/time-multiple-fields/time-multiple-fields-change-type-expected.txt: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-change-type.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (132450 => 132451)
--- trunk/LayoutTests/ChangeLog 2012-10-25 06:38:20 UTC (rev 132450)
+++ trunk/LayoutTests/ChangeLog 2012-10-25 06:42:27 UTC (rev 132451)
@@ -1,3 +1,13 @@
+2012-10-24 Kent Tamura <[email protected]>
+
+ REGRESSION(r132291): Crash in BaseMultipleFieldsDateAndTimeInputType
+ https://bugs.webkit.org/show_bug.cgi?id=100326
+
+ Reviewed by Eric Seidel.
+
+ * fast/forms/time-multiple-fields/time-multiple-fields-change-type-expected.txt: Added.
+ * fast/forms/time-multiple-fields/time-multiple-fields-change-type.html: Added.
+
2012-10-24 Pavel Feldman <[email protected]>
Not reviewed: updating chromium TestExpectations for the roll.
Added: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-change-type-expected.txt (0 => 132451)
--- trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-change-type-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-change-type-expected.txt 2012-10-25 06:42:27 UTC (rev 132451)
@@ -0,0 +1 @@
+PASS if not crashed.
Added: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-change-type.html (0 => 132451)
--- trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-change-type.html (rev 0)
+++ trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-change-type.html 2012-10-25 06:42:27 UTC (rev 132451)
@@ -0,0 +1,10 @@
+<body>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+var i = document.createElement('input');
+i.type = 'time';
+i.type = 'text';
+</script>
+PASS if not crashed.
+</body>
Modified: trunk/Source/WebCore/ChangeLog (132450 => 132451)
--- trunk/Source/WebCore/ChangeLog 2012-10-25 06:38:20 UTC (rev 132450)
+++ trunk/Source/WebCore/ChangeLog 2012-10-25 06:42:27 UTC (rev 132451)
@@ -1,3 +1,16 @@
+2012-10-24 Kent Tamura <[email protected]>
+
+ REGRESSION(r132291): Crash in BaseMultipleFieldsDateAndTimeInputType
+ https://bugs.webkit.org/show_bug.cgi?id=100326
+
+ Reviewed by Eric Seidel.
+
+ Test: fast/forms/time-multiple-fields/time-multiple-fields-change-type.html
+
+ * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
+ (WebCore::BaseMultipleFieldsDateAndTimeInputType::destroyShadowSubtree):
+ We need to disconnect m_spinButtonElement before destructing the UA shadow tree.
+
2012-10-24 Adam Barth <[email protected]>
[V8] DOMData is no longer needed
Modified: trunk/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp (132450 => 132451)
--- trunk/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp 2012-10-25 06:38:20 UTC (rev 132450)
+++ trunk/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp 2012-10-25 06:42:27 UTC (rev 132451)
@@ -197,6 +197,10 @@
void BaseMultipleFieldsDateAndTimeInputType::destroyShadowSubtree()
{
+ if (m_spinButtonElement) {
+ m_spinButtonElement->removeSpinButtonOwner();
+ m_spinButtonElement = 0;
+ }
if (m_dateTimeEditElement) {
m_dateTimeEditElement->removeEditControlOwner();
m_dateTimeEditElement = 0;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
