Title: [110670] branches/chromium/1025
- Revision
- 110670
- Author
- [email protected]
- Date
- 2012-03-14 00:31:33 -0700 (Wed, 14 Mar 2012)
Log Message
Merge 110226 - NULL renderer possible in WebCore::HTMLInputElement::setCanReceiveDroppedFiles()
https://bugs.webkit.org/show_bug.cgi?id=80648
Reviewed by Simon Fraser.
Source/WebCore:
Test: fast/events/input-element-display-none-in-dragleave-crash.html
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setCanReceiveDroppedFiles): NULL-check renderer().
LayoutTests:
* fast/events/input-element-display-none-in-dragleave-crash-expected.txt: Added.
* fast/events/input-element-display-none-in-dragleave-crash.html: Added.
* platform/wk2/Skipped: WebKitTestRunner doesn't support
EventSender.beginDragWithFiles().
[email protected]
Review URL: https://chromiumcodereview.appspot.com/9699014
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash-expected.txt (from rev 110226, trunk/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash-expected.txt) (0 => 110670)
--- branches/chromium/1025/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash-expected.txt 2012-03-14 07:31:33 UTC (rev 110670)
@@ -0,0 +1,3 @@
+This test passes if there is no crash when dragging a file over and then away from the file input element below.
+
+
Copied: branches/chromium/1025/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash.html (from rev 110226, trunk/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash.html) (0 => 110670)
--- branches/chromium/1025/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/events/input-element-display-none-in-dragleave-crash.html 2012-03-14 07:31:33 UTC (rev 110670)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ function test()
+ {
+ var dropTarget = document.getElementById("drop-target");
+ dropTarget.addEventListener("dragleave", function() {
+ dropTarget.style.display = "none";
+ }, false);
+
+ if (window.eventSender) {
+ eventSender.beginDragWithFiles(["resources/abe.png"]);
+ var x = dropTarget.offsetLeft + dropTarget.offsetWidth / 2;
+ var y = dropTarget.offsetTop + dropTarget.offsetHeight / 2;
+ eventSender.mouseMoveTo(x, y);
+ eventSender.mouseMoveTo(0, 0);
+ }
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+ </script>
+</head>
+<body _onload_="test()">
+ <p>This test passes if there is no crash when dragging a file over and then away from the file input element below.</p>
+ <input type="file" id="drop-target">
+</body>
+</html>
\ No newline at end of file
Modified: branches/chromium/1025/Source/WebCore/html/HTMLInputElement.cpp (110669 => 110670)
--- branches/chromium/1025/Source/WebCore/html/HTMLInputElement.cpp 2012-03-14 07:23:49 UTC (rev 110669)
+++ branches/chromium/1025/Source/WebCore/html/HTMLInputElement.cpp 2012-03-14 07:31:33 UTC (rev 110670)
@@ -1374,7 +1374,8 @@
if (m_canReceiveDroppedFiles == canReceiveDroppedFiles)
return;
m_canReceiveDroppedFiles = canReceiveDroppedFiles;
- renderer()->updateFromElement();
+ if (renderer())
+ renderer()->updateFromElement();
}
String HTMLInputElement::visibleValue() const
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
