Title: [93079] trunk
- Revision
- 93079
- Author
- hay...@chromium.org
- Date
- 2011-08-15 18:05:40 -0700 (Mon, 15 Aug 2011)
Log Message
Fix crash when mouse moves from <summary> element to parent <details> element.
https://bugs.webkit.org/show_bug.cgi?id=66210
Reviewed by Dimitri Glazkov.
This is a regression caused by r92922, which wrongly assumes that
a shadow host always has a shadow root as an immediate child in
ancestors chain. This assumption does not apply to <details>
element. <details> element is implemented as a shadow host, but
may have a <summary> element as an immediate child element in
ancestors chain.
Source/WebCore:
Test: fast/dom/shadow/details-summary-mouseover.html
* dom/EventDispatcher.cpp:
(WebCore::EventDispatcher::adjustToShadowBoundaries):
LayoutTests:
* fast/dom/shadow/details-summary-mouseover-expected.txt: Added.
* fast/dom/shadow/details-summary-mouseover.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (93078 => 93079)
--- trunk/LayoutTests/ChangeLog 2011-08-16 00:56:26 UTC (rev 93078)
+++ trunk/LayoutTests/ChangeLog 2011-08-16 01:05:40 UTC (rev 93079)
@@ -1,3 +1,20 @@
+2011-08-15 Hayato Ito <hay...@chromium.org>
+
+ Fix crash when mouse moves from <summary> element to parent <details> element.
+ https://bugs.webkit.org/show_bug.cgi?id=66210
+
+ Reviewed by Dimitri Glazkov.
+
+ This is a regression caused by r92922, which wrongly assumes that
+ a shadow host always has a shadow root as an immediate child in
+ ancestors chain. This assumption does not apply to <details>
+ element. <details> element is implemented as a shadow host, but
+ may have a <summary> element as an immediate child element in
+ ancestors chain.
+
+ * fast/dom/shadow/details-summary-mouseover-expected.txt: Added.
+ * fast/dom/shadow/details-summary-mouseover.html: Added.
+
2011-08-15 Ryosuke Niwa <rn...@webkit.org>
A mousedown event is not dispatched when clicking on a disabled INPUT
Added: trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover-expected.txt (0 => 93079)
--- trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover-expected.txt 2011-08-16 01:05:40 UTC (rev 93079)
@@ -0,0 +1,11 @@
+Tests to ensure that moving mouse from 'summary' to 'details' should not crash. Note that 'details' is a shadow host and has a 'summary' element as a immediate child elment. There is no shadow root between them.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+summary
+details
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover.html (0 => 93079)
--- trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover.html 2011-08-16 01:05:40 UTC (rev 93079)
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<div id="sandbox">
+ <details open id="details" style="height: 200px">
+ <summary id="summary">summary</summary>
+ details
+ </details>
+</div>
+<pre id="console"></pre>
+<script>
+description("Tests to ensure that moving mouse from 'summary' to 'details' should not crash. "
+ + "Note that 'details' is a shadow host and has a 'summary' element as a immediate child elment. "
+ + "There is no shadow root between them.");
+
+function moveMouseOver(element)
+{
+ if (!window.eventSender)
+ return;
+ var x = element.offsetLeft + element.offsetWidth / 2;
+ var y = element.offsetTop + element.offsetHeight / 2;
+ eventSender.mouseMoveTo(x, y);
+}
+
+function test()
+{
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ moveMouseOver(document.getElementById('summary'));
+ moveMouseOver(document.getElementById('details'));
+}
+
+test();
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/dom/shadow/details-summary-mouseover.html
___________________________________________________________________
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (93078 => 93079)
--- trunk/Source/WebCore/ChangeLog 2011-08-16 00:56:26 UTC (rev 93078)
+++ trunk/Source/WebCore/ChangeLog 2011-08-16 01:05:40 UTC (rev 93079)
@@ -1,3 +1,22 @@
+2011-08-15 Hayato Ito <hay...@chromium.org>
+
+ Fix crash when mouse moves from <summary> element to parent <details> element.
+ https://bugs.webkit.org/show_bug.cgi?id=66210
+
+ Reviewed by Dimitri Glazkov.
+
+ This is a regression caused by r92922, which wrongly assumes that
+ a shadow host always has a shadow root as an immediate child in
+ ancestors chain. This assumption does not apply to <details>
+ element. <details> element is implemented as a shadow host, but
+ may have a <summary> element as an immediate child element in
+ ancestors chain.
+
+ Test: fast/dom/shadow/details-summary-mouseover.html
+
+ * dom/EventDispatcher.cpp:
+ (WebCore::EventDispatcher::adjustToShadowBoundaries):
+
2011-08-15 Jeffrey Pfau <jp...@apple.com>
New XML parser: Use xmlnsAtom instead of redundant xmlnsPrefix
Modified: trunk/Source/WebCore/dom/EventDispatcher.cpp (93078 => 93079)
--- trunk/Source/WebCore/dom/EventDispatcher.cpp 2011-08-16 00:56:26 UTC (rev 93078)
+++ trunk/Source/WebCore/dom/EventDispatcher.cpp 2011-08-16 01:05:40 UTC (rev 93079)
@@ -165,8 +165,9 @@
// The relatedTarget is an ancestor or shadowHost of the target.
// FIXME: Remove the first check once conversion to new shadow DOM is complete <http://webkit.org/b/48698>
if (m_node->shadowHost() == relatedTarget.get() || isShadowHost(relatedTarget.get())) {
- ASSERT(targetAncestor - 1 >= m_ancestors.begin());
- lowestCommonBoundary = targetAncestor - 1;
+ lowestCommonBoundary = targetAncestor;
+ if (targetAncestor - 1 >= m_ancestors.begin() && isShadowRootOrSVGShadowRoot((targetAncestor - 1)->node()))
+ lowestCommonBoundary = targetAncestor - 1;
}
} else if ((*firstDivergentBoundary) == m_node.get()) {
// Since ancestors does not contain target itself, we must account
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
