Title: [136309] trunk/Source/WebCore
- Revision
- 136309
- Author
- [email protected]
- Date
- 2012-12-01 04:39:25 -0800 (Sat, 01 Dec 2012)
Log Message
DRT - crashed in WebCore::SearchFieldCancelButtonElement::defaultEventHandler
https://bugs.webkit.org/show_bug.cgi?id=103592
Patch by Xiaobo Wang <[email protected]> on 2012-12-01
Reviewed by Kent Tamura.
The crash happened when the search field cancel button handles mouseout
event after the search input was detached. When it happens the input
element returned from shadowHost() is null, need to check the pointer
before dereferencing.
InputFieldSpeechButton and SearchFieldResultsButtonElement have the
similar issue.
No new tests. The patch fixes the following test on BlackBerry platform.
Test: fast/forms/search-delete-while-cancel-button-clicked.html
* html/shadow/TextControlInnerElements.cpp:
(WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
(WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
(WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents):
(WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
(WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
(WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (136308 => 136309)
--- trunk/Source/WebCore/ChangeLog 2012-12-01 11:09:27 UTC (rev 136308)
+++ trunk/Source/WebCore/ChangeLog 2012-12-01 12:39:25 UTC (rev 136309)
@@ -1,3 +1,28 @@
+2012-12-01 Xiaobo Wang <[email protected]>
+
+ DRT - crashed in WebCore::SearchFieldCancelButtonElement::defaultEventHandler
+ https://bugs.webkit.org/show_bug.cgi?id=103592
+
+ Reviewed by Kent Tamura.
+
+ The crash happened when the search field cancel button handles mouseout
+ event after the search input was detached. When it happens the input
+ element returned from shadowHost() is null, need to check the pointer
+ before dereferencing.
+ InputFieldSpeechButton and SearchFieldResultsButtonElement have the
+ similar issue.
+
+ No new tests. The patch fixes the following test on BlackBerry platform.
+ Test: fast/forms/search-delete-while-cancel-button-clicked.html
+
+ * html/shadow/TextControlInnerElements.cpp:
+ (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+ (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+ (WebCore::SearchFieldCancelButtonElement::willRespondToMouseClickEvents):
+ (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+ (WebCore::InputFieldSpeechButtonElement::willRespondToMouseClickEvents):
+ (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
+
2012-11-30 Mike West <[email protected]>
CSP 1.1: Make the CSP_NEXT flag runtime enabled.
Modified: trunk/Source/WebCore/html/shadow/TextControlInnerElements.cpp (136308 => 136309)
--- trunk/Source/WebCore/html/shadow/TextControlInnerElements.cpp 2012-12-01 11:09:27 UTC (rev 136308)
+++ trunk/Source/WebCore/html/shadow/TextControlInnerElements.cpp 2012-12-01 12:39:25 UTC (rev 136309)
@@ -144,7 +144,7 @@
{
// On mousedown, bring up a menu, if needed
HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
- if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+ if (input && event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
input->focus();
input->select();
RenderSearchField* renderer = toRenderSearchField(input->renderer());
@@ -197,7 +197,7 @@
{
// If the element is visible, on mouseup, clear the value, and set selection
RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
- if (input->disabled() || input->readOnly()) {
+ if (!input || input->disabled() || input->readOnly()) {
if (!event->defaultHandled())
HTMLDivElement::defaultEventHandler(event);
return;
@@ -236,7 +236,7 @@
bool SearchFieldCancelButtonElement::willRespondToMouseClickEvents()
{
const HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
- if (!input->disabled() && !input->readOnly())
+ if (input && !input->disabled() && !input->readOnly())
return true;
return HTMLDivElement::willRespondToMouseClickEvents();
@@ -282,7 +282,7 @@
// here, we take a temporary reference.
RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
- if (input->disabled() || input->readOnly()) {
+ if (!input || input->disabled() || input->readOnly()) {
if (!event->defaultHandled())
HTMLDivElement::defaultEventHandler(event);
return;
@@ -333,7 +333,7 @@
bool InputFieldSpeechButtonElement::willRespondToMouseClickEvents()
{
const HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
- if (!input->disabled() && !input->readOnly())
+ if (input && !input->disabled() && !input->readOnly())
return true;
return HTMLDivElement::willRespondToMouseClickEvents();
@@ -370,7 +370,7 @@
// remove the input element from DOM. To make sure it remains valid until we finish our work
// here, we take a temporary reference.
RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
- if (input->disabled() || input->readOnly())
+ if (!input || input->disabled() || input->readOnly())
return;
RefPtr<InputFieldSpeechButtonElement> holdRefButton(this);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
