Title: [245746] trunk
- Revision
- 245746
- Author
- [email protected]
- Date
- 2019-05-24 09:33:57 -0700 (Fri, 24 May 2019)
Log Message
Asssertion failure in dispatchSubtreeModifiedEvent due to TextFieldInputType updating UA shadow tree inside Element::removedFromAncestor
https://bugs.webkit.org/show_bug.cgi?id=198216
Reviewed by Brent Fulgham.
Source/WebCore:
The bug was caused by ListAttributeTargetObserver::idTargetChanged() updating the shadow tree of an input element
within Element::removedFromAncestor via TextFieldInputType::createDataListDropdownIndicator(). Fixed it by
supressing the assertions with ScriptDisallowedScope::EventAllowedScope since it's always safe to update
UA shadow trees of input elements as it's not exposed to author scripts.
Avoiding the creation of dropdown indicator in this particular scenario is a lot more involved and it's not
particularly correct because there could be another datalist element which matches the ID specified in list
content attribute after the removal of the old datalist element.
Test: fast/forms/datalist/datalist-removal-assertion.html
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::createDataListDropdownIndicator):
(WebCore::TextFieldInputType::createContainer):
* html/shadow/DataListButtonElement.cpp:
(WebCore::DataListButtonElement::DataListButtonElement):
LayoutTests:
Added a regression test.
* fast/forms/datalist/datalist-removal-assertion-expected.txt: Added.
* fast/forms/datalist/datalist-removal-assertion.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (245745 => 245746)
--- trunk/LayoutTests/ChangeLog 2019-05-24 08:19:07 UTC (rev 245745)
+++ trunk/LayoutTests/ChangeLog 2019-05-24 16:33:57 UTC (rev 245746)
@@ -1,3 +1,15 @@
+2019-05-24 Ryosuke Niwa <[email protected]>
+
+ Asssertion failure in dispatchSubtreeModifiedEvent due to TextFieldInputType updating UA shadow tree inside Element::removedFromAncestor
+ https://bugs.webkit.org/show_bug.cgi?id=198216
+
+ Reviewed by Brent Fulgham.
+
+ Added a regression test.
+
+ * fast/forms/datalist/datalist-removal-assertion-expected.txt: Added.
+ * fast/forms/datalist/datalist-removal-assertion.html: Added.
+
2019-05-23 Simon Fraser <[email protected]>
With async overflow scrolling, programmatic scroll to a negative offset fails to clamp the scroll offset
Added: trunk/LayoutTests/fast/forms/datalist/datalist-removal-assertion-expected.txt (0 => 245746)
--- trunk/LayoutTests/fast/forms/datalist/datalist-removal-assertion-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/datalist/datalist-removal-assertion-expected.txt 2019-05-24 16:33:57 UTC (rev 245746)
@@ -0,0 +1,4 @@
+This tests removing the datalist element immediately after changing the type of the input element's type.
+WebKit should not hit a debug assertion.
+
+PASS
Added: trunk/LayoutTests/fast/forms/datalist/datalist-removal-assertion.html (0 => 245746)
--- trunk/LayoutTests/fast/forms/datalist/datalist-removal-assertion.html (rev 0)
+++ trunk/LayoutTests/fast/forms/datalist/datalist-removal-assertion.html 2019-05-24 16:33:57 UTC (rev 245746)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests removing the datalist element immediately after changing the type of the input element's type.<br>
+WebKit should not hit a debug assertion.</p>
+<input id="input" list="fruits" type="checkbox">
+<datalist id="fruits">
+ <option>Orange</option>
+ <option>Pear</option>
+ <option>Apple</option>
+</datalist>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+input.type = 'text';
+fruits.remove();
+input.remove();
+document.write('PASS');
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (245745 => 245746)
--- trunk/Source/WebCore/ChangeLog 2019-05-24 08:19:07 UTC (rev 245745)
+++ trunk/Source/WebCore/ChangeLog 2019-05-24 16:33:57 UTC (rev 245746)
@@ -1,3 +1,27 @@
+2019-05-24 Ryosuke Niwa <[email protected]>
+
+ Asssertion failure in dispatchSubtreeModifiedEvent due to TextFieldInputType updating UA shadow tree inside Element::removedFromAncestor
+ https://bugs.webkit.org/show_bug.cgi?id=198216
+
+ Reviewed by Brent Fulgham.
+
+ The bug was caused by ListAttributeTargetObserver::idTargetChanged() updating the shadow tree of an input element
+ within Element::removedFromAncestor via TextFieldInputType::createDataListDropdownIndicator(). Fixed it by
+ supressing the assertions with ScriptDisallowedScope::EventAllowedScope since it's always safe to update
+ UA shadow trees of input elements as it's not exposed to author scripts.
+
+ Avoiding the creation of dropdown indicator in this particular scenario is a lot more involved and it's not
+ particularly correct because there could be another datalist element which matches the ID specified in list
+ content attribute after the removal of the old datalist element.
+
+ Test: fast/forms/datalist/datalist-removal-assertion.html
+
+ * html/TextFieldInputType.cpp:
+ (WebCore::TextFieldInputType::createDataListDropdownIndicator):
+ (WebCore::TextFieldInputType::createContainer):
+ * html/shadow/DataListButtonElement.cpp:
+ (WebCore::DataListButtonElement::DataListButtonElement):
+
2019-05-24 Saam barati <[email protected]>
[WHLSL] ReadModifyWriteExpression always has a result and new value _expression_
Modified: trunk/Source/WebCore/html/TextFieldInputType.cpp (245745 => 245746)
--- trunk/Source/WebCore/html/TextFieldInputType.cpp 2019-05-24 08:19:07 UTC (rev 245745)
+++ trunk/Source/WebCore/html/TextFieldInputType.cpp 2019-05-24 16:33:57 UTC (rev 245746)
@@ -52,6 +52,7 @@
#include "RenderTextControlSingleLine.h"
#include "RenderTheme.h"
#include "RuntimeEnabledFeatures.h"
+#include "ScriptDisallowedScope.h"
#include "ShadowRoot.h"
#include "TextControlInnerElements.h"
#include "TextEvent.h"
@@ -452,9 +453,13 @@
ASSERT(!m_dataListDropdownIndicator);
if (!m_container)
createContainer();
+
+ ScriptDisallowedScope::EventAllowedScope allowedScope(*m_container);
m_dataListDropdownIndicator = DataListButtonElement::create(element()->document(), *this);
+ m_container->appendChild(*m_dataListDropdownIndicator);
+ m_dataListDropdownIndicator->setPseudo(AtomicString("-webkit-list-button", AtomicString::ConstructFromLiteral));
m_dataListDropdownIndicator->setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone, true);
- m_container->appendChild(*m_dataListDropdownIndicator);
+
}
#endif
@@ -773,14 +778,15 @@
ASSERT(!m_container);
ASSERT(element());
+ ScriptDisallowedScope::EventAllowedScope allowedScope(*element()->userAgentShadowRoot());
+
m_container = TextControlInnerContainer::create(element()->document());
+ element()->userAgentShadowRoot()->appendChild(*m_container);
m_container->setPseudo(AtomicString("-webkit-textfield-decoration-container", AtomicString::ConstructFromLiteral));
m_innerBlock = TextControlInnerElement::create(element()->document());
+ m_container->appendChild(*m_innerBlock);
m_innerBlock->appendChild(*m_innerText);
- m_container->appendChild(*m_innerBlock);
-
- element()->userAgentShadowRoot()->appendChild(*m_container);
}
void TextFieldInputType::createAutoFillButton(AutoFillButtonType autoFillButtonType)
Modified: trunk/Source/WebCore/html/shadow/DataListButtonElement.cpp (245745 => 245746)
--- trunk/Source/WebCore/html/shadow/DataListButtonElement.cpp 2019-05-24 08:19:07 UTC (rev 245745)
+++ trunk/Source/WebCore/html/shadow/DataListButtonElement.cpp 2019-05-24 16:33:57 UTC (rev 245746)
@@ -49,7 +49,6 @@
: HTMLDivElement(divTag, document)
, m_owner(owner)
{
- setPseudo(AtomicString("-webkit-list-button", AtomicString::ConstructFromLiteral));
}
DataListButtonElement::~DataListButtonElement() { }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
