- Revision
- 129448
- Author
- [email protected]
- Date
- 2012-09-24 20:26:31 -0700 (Mon, 24 Sep 2012)
Log Message
Document::adoptNode for multiple fields time input UI should not crash
https://bugs.webkit.org/show_bug.cgi?id=97428
Reviewed by Dimitri Glazkov.
Source/WebCore:
This patch changes Document::removeFocusedNodeOfSubtree() to check
focused node in shadow DOM tree for avoiding Document::m_focusedNode
not to have dangling pointer to field owner in DateTimeFieldElement.
Test:
- fast/dom/shadow/shadow-removechild-and-blur-event.html: test for removeChild dispatches blur event.
- fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html: test for adoptNode not to crash.
- fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur.html: removeChild of input type "time" dispatches blur event, existing test.
* dom/Document.cpp:
(WebCore::Document::removeFocusedNodeOfSubtree): Changed to check
focused node in shadow DOM tree in addition to descendant node.
LayoutTests:
This patch adds a test for checking removeChild() of shadow host
dispatches blur event if focused node in shadow tree, a test for
checking adoptNode() doesn't causes crash and dispatches blur event
during document.adoptNode() and updates expectation for focus/blur event test.
* fast/dom/shadow/shadow-removechild-and-blur-event-expectation.txt: Added.
* fast/dom/shadow/shadow-removechild-and-blur-event.html: Added for checking removeChild of shadow host dispatchs blur event when focused node in shadow tree.
* fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode-expected.txt: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur-expected.txt: Updated to expectation to have output from blur event handler.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (129447 => 129448)
--- trunk/LayoutTests/ChangeLog 2012-09-25 03:22:13 UTC (rev 129447)
+++ trunk/LayoutTests/ChangeLog 2012-09-25 03:26:31 UTC (rev 129448)
@@ -1,3 +1,21 @@
+2012-09-24 Yoshifumi Inoue <[email protected]>
+
+ Document::adoptNode for multiple fields time input UI should not crash
+ https://bugs.webkit.org/show_bug.cgi?id=97428
+
+ Reviewed by Dimitri Glazkov.
+
+ This patch adds a test for checking removeChild() of shadow host
+ dispatches blur event if focused node in shadow tree, a test for
+ checking adoptNode() doesn't causes crash and dispatches blur event
+ during document.adoptNode() and updates expectation for focus/blur event test.
+
+ * fast/dom/shadow/shadow-removechild-and-blur-event-expectation.txt: Added.
+ * fast/dom/shadow/shadow-removechild-and-blur-event.html: Added for checking removeChild of shadow host dispatchs blur event when focused node in shadow tree.
+ * fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode-expected.txt: Added.
+ * fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html: Added.
+ * fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur-expected.txt: Updated to expectation to have output from blur event handler.
+
2012-09-24 Benjamin Poulain <[email protected]>
We should not expect percent-escaped hostname for invalid URLs
Copied: trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event-expected.txt (from rev 129447, trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur-expected.txt) (0 => 129448)
--- trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event-expected.txt 2012-09-25 03:26:31 UTC (rev 129448)
@@ -0,0 +1,10 @@
+Check focused shadow node dispatchs blur event on removeChild of host.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS logs.toString() is "start-removeChild,blur,end-removeChild"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event.html (0 => 129448)
--- trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event.html 2012-09-25 03:26:31 UTC (rev 129448)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<span id=test></span>
+<div id="console"></div>
+<script>
+description('Check focused shadow node dispatchs blur event on removeChild of host.');
+var logs = [];
+var test = document.getElementById('test');
+var shadow = new WebKitShadowRoot(test);
+var input = document.createElement("input");
+shadow.appendChild(input);
+input.addEventListener('blur', function () { logs.push('blur'); });
+input.focus();
+logs.push('start-removeChild');
+test.parentNode.removeChild(test);
+logs.push('end-removeChild');
+shouldBeEqualToString('logs.toString()', 'start-removeChild,blur,end-removeChild');
+</script>
+<script src=""
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/dom/shadow/shadow-removechild-and-blur-event.html
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode-expected.txt (0 => 129448)
--- trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode-expected.txt 2012-09-25 03:26:31 UTC (rev 129448)
@@ -0,0 +1,11 @@
+Check adoptNode dispatchs blur event for multiple fields time input UI
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS logs.toString() is "start-adoptNode,blur,end-adoptNode,start-focus,end-focus"
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html (0 => 129448)
--- trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html (rev 0)
+++ trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html 2012-09-25 03:26:31 UTC (rev 129448)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="container">
+<input autofocus id="test" type="time" value="12:34">
+</div>
+<script>
+description('Check adoptNode dispatchs blur event for multiple fields time input UI');
+var container = document.getElementById("container");
+var testInput = document.getElementById('test');
+var logs = [];
+testInput.addEventListener('blur', function () { logs.push('blur'); });
+logs.push('start-adoptNode');
+document.implementation.createDocument('', '', null).adoptNode(testInput);
+logs.push('end-adoptNode');
+testInput.setAttribute('x', 'x');
+testInput.setAttribute('type', 'submit');
+container.appendChild(testInput);
+logs.push('start-focus');
+testInput.focus();
+logs.push('end-focus');
+shouldBeEqualToString('logs.toString()', 'start-adoptNode,blur,end-adoptNode,start-focus,end-focus');
+debug('');
+document.body.removeChild(container);
+</script>
+<script src=""
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html
___________________________________________________________________
Added: svn:eol-style
Modified: trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur-expected.txt (129447 => 129448)
--- trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur-expected.txt 2012-09-25 03:22:13 UTC (rev 129447)
+++ trunk/LayoutTests/fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur-expected.txt 2012-09-25 03:26:31 UTC (rev 129448)
@@ -8,6 +8,8 @@
Existing focus event handler
focus() finished
+Entering blur event handler
+Existing blur event handler
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/Source/WebCore/ChangeLog (129447 => 129448)
--- trunk/Source/WebCore/ChangeLog 2012-09-25 03:22:13 UTC (rev 129447)
+++ trunk/Source/WebCore/ChangeLog 2012-09-25 03:26:31 UTC (rev 129448)
@@ -1,3 +1,23 @@
+2012-09-24 Yoshifumi Inoue <[email protected]>
+
+ Document::adoptNode for multiple fields time input UI should not crash
+ https://bugs.webkit.org/show_bug.cgi?id=97428
+
+ Reviewed by Dimitri Glazkov.
+
+ This patch changes Document::removeFocusedNodeOfSubtree() to check
+ focused node in shadow DOM tree for avoiding Document::m_focusedNode
+ not to have dangling pointer to field owner in DateTimeFieldElement.
+
+ Test:
+ - fast/dom/shadow/shadow-removechild-and-blur-event.html: test for removeChild dispatches blur event.
+ - fast/forms/time-multiple-fields/time-multiple-fields-crash-after-adoptnode.html: test for adoptNode not to crash.
+ - fast/forms/time-multiple-fields/time-multiple-fields-state-change-on-focus-or-blur.html: removeChild of input type "time" dispatches blur event, existing test.
+
+ * dom/Document.cpp:
+ (WebCore::Document::removeFocusedNodeOfSubtree): Changed to check
+ focused node in shadow DOM tree in addition to descendant node.
+
2012-09-24 Robin Cao <[email protected]>
[Blackberry] Add a software rendering path for media player
Modified: trunk/Source/WebCore/dom/Document.cpp (129447 => 129448)
--- trunk/Source/WebCore/dom/Document.cpp 2012-09-25 03:22:13 UTC (rev 129447)
+++ trunk/Source/WebCore/dom/Document.cpp 2012-09-25 03:26:31 UTC (rev 129448)
@@ -3308,12 +3308,16 @@
{
if (!m_focusedNode || this->inPageCache()) // If the document is in the page cache, then we don't need to clear out the focused node.
return;
-
+
+ Node* focusedNode = node->treeScope()->focusedNode();
+ if (!focusedNode)
+ return;
+
bool nodeInSubtree = false;
if (amongChildrenOnly)
- nodeInSubtree = m_focusedNode->isDescendantOf(node);
+ nodeInSubtree = focusedNode->isDescendantOf(node);
else
- nodeInSubtree = (m_focusedNode == node) || m_focusedNode->isDescendantOf(node);
+ nodeInSubtree = (focusedNode == node) || focusedNode->isDescendantOf(node);
if (nodeInSubtree)
document()->focusedNodeRemoved();
