[webkit-changes] [146038] trunk
Title: [146038] trunk Revision 146038 Author domin...@chromium.org Date 2013-03-18 01:01:57 -0700 (Mon, 18 Mar 2013) Log Message A placeholder renderer should not be taken to imply the existence of a text renderer in single line text controls https://bugs.webkit.org/show_bug.cgi?id=112410 Reviewed by Tony Chang. Source/WebCore: The assumption that if a text control had a placeholder renderer then it also had a text renderer is not valid. If ::-webkit-textfield-decoration-controller is set to display: none; a single line text control's decoration container renderer and hence text renderer are not created. This change handles this corner case where a text control has a placeholder renderer but not a text renderer. Tests: fast/forms/search/search-hide-decoration-container-crash.html (Updated) * html/HTMLTextFormControlElement.cpp: (WebCore::HTMLTextFormControlElement::fixPlaceholderRenderer): * rendering/RenderTextControlSingleLine.cpp: (WebCore::RenderTextControlSingleLine::layout): LayoutTests: Update search-hide-decoration-container-crash.html to exercise non-null placeholder renderers and null text renderers. Cases where neither are rendered already get coverage in search-scroll-hidden-decoration-container-crash.html and search-autoscroll-hidden-decoration-container-crash.html. * fast/forms/search/search-hide-decoration-container-crash.html: * fast/forms/search/search-hide-decoration-container-crash-expected.txt: Modified Paths trunk/LayoutTests/ChangeLog trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash-expected.txt trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash.html trunk/Source/WebCore/ChangeLog trunk/Source/WebCore/html/HTMLTextFormControlElement.cpp trunk/Source/WebCore/rendering/RenderTextControlSingleLine.cpp Diff Modified: trunk/LayoutTests/ChangeLog (146037 => 146038) --- trunk/LayoutTests/ChangeLog 2013-03-18 07:55:30 UTC (rev 146037) +++ trunk/LayoutTests/ChangeLog 2013-03-18 08:01:57 UTC (rev 146038) @@ -1,5 +1,22 @@ 2013-03-18 Dominic Cooney +A placeholder renderer should not be taken to imply the existence of a text renderer in single line text controls +https://bugs.webkit.org/show_bug.cgi?id=112410 + +Reviewed by Tony Chang. + +Update search-hide-decoration-container-crash.html to exercise +non-null placeholder renderers and null text renderers. + +Cases where neither are rendered already get coverage in +search-scroll-hidden-decoration-container-crash.html and +search-autoscroll-hidden-decoration-container-crash.html. + +* fast/forms/search/search-hide-decoration-container-crash.html: +* fast/forms/search/search-hide-decoration-container-crash-expected.txt: + +2013-03-18 Dominic Cooney + [Shadow] offsetParent should never return nodes in user agent Shadow DOM to script https://bugs.webkit.org/show_bug.cgi?id=112530 Modified: trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash-expected.txt (146037 => 146038) --- trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash-expected.txt 2013-03-18 07:55:30 UTC (rev 146037) +++ trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash-expected.txt 2013-03-18 08:01:57 UTC (rev 146038) @@ -1 +1 @@ - PASS + PASS Modified: trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash.html (146037 => 146038) --- trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash.html 2013-03-18 07:55:30 UTC (rev 146037) +++ trunk/LayoutTests/fast/forms/search/search-hide-decoration-container-crash.html 2013-03-18 08:01:57 UTC (rev 146038) @@ -9,4 +9,5 @@ } + PASS Modified: trunk/Source/WebCore/ChangeLog (146037 => 146038) --- trunk/Source/WebCore/ChangeLog 2013-03-18 07:55:30 UTC (rev 146037) +++ trunk/Source/WebCore/ChangeLog 2013-03-18 08:01:57 UTC (rev 146038) @@ -1,5 +1,27 @@ 2013-03-18 Dominic Cooney +A placeholder renderer should not be taken to imply the existence of a text renderer in single line text controls +https://bugs.webkit.org/show_bug.cgi?id=112410 + +Reviewed by Tony Chang. + +The assumption that if a text control had a placeholder renderer +then it also had a text renderer is not valid. If +::-webkit-textfield-decoration-controller is set to display: none; +a single line text control's decoration container renderer and +hence text renderer are not created. This change handles this +corner case where a text control has a placeholder renderer but +not a text renderer. + +Tests: fast/forms/search/search-hide-decoration-container-crash.html (Updated) + +* html/HTMLTextFormControlElement.cpp: +(WebCore::HTMLTextFormControlElement::fixPlaceholderRenderer): +* rendering/RenderTextControlSingleLine.cpp: +(WebCore::RenderTextControlSingleLi
[webkit-changes] [146037] trunk
Title: [146037] trunk Revision 146037 Author domin...@chromium.org Date 2013-03-18 00:55:30 -0700 (Mon, 18 Mar 2013) Log Message [Shadow] offsetParent should never return nodes in user agent Shadow DOM to script https://bugs.webkit.org/show_bug.cgi?id=112530 Reviewed by Elliott Sprehn. Source/WebCore: Test: fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html * dom/Element.cpp: (WebCore::Element::bindingsOffsetParent): Filter nodes in UA shadows. * dom/Element.h: (Element): Add bindingsOffsetParent. * dom/Element.idl: bindingsOffsetParent is the implementation of offsetParent. LayoutTests: * fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt: Added. * fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html: Added. Modified Paths trunk/LayoutTests/ChangeLog trunk/Source/WebCore/ChangeLog trunk/Source/WebCore/dom/Element.cpp trunk/Source/WebCore/dom/Element.h trunk/Source/WebCore/dom/Element.idl Added Paths trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html Diff Modified: trunk/LayoutTests/ChangeLog (146036 => 146037) --- trunk/LayoutTests/ChangeLog 2013-03-18 06:40:04 UTC (rev 146036) +++ trunk/LayoutTests/ChangeLog 2013-03-18 07:55:30 UTC (rev 146037) @@ -1,3 +1,13 @@ +2013-03-18 Dominic Cooney + +[Shadow] offsetParent should never return nodes in user agent Shadow DOM to script +https://bugs.webkit.org/show_bug.cgi?id=112530 + +Reviewed by Elliott Sprehn. + +* fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt: Added. +* fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html: Added. + 2013-03-17 Simon Fraser Mark some more tests as flakey, or asserting in debug. Added: trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt (0 => 146037) --- trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt (rev 0) +++ trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow-expected.txt 2013-03-18 07:55:30 UTC (rev 146037) @@ -0,0 +1,13 @@ +offsetParent should not leak nodes in user agent Shadow DOM. + +On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". + + +PASS child.offsetParent is shadow.positionedElement +PASS child.offsetParent is container +PASS child.offsetParent is null +PASS child.offsetParent is container +PASS successfullyParsed is true + +TEST COMPLETE + Added: trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html (0 => 146037) --- trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html (rev 0) +++ trunk/LayoutTests/fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html 2013-03-18 07:55:30 UTC (rev 146037) @@ -0,0 +1,52 @@ + + + +