Attachment 102544 Details for Bug 65362 – fixes the bug

[patch] fixes the bug

bug-65362-20110801123320.patch (text/plain), 4.98 KB, created by Ryosuke Niwa on 2011-08-01 12:33:21 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ryosuke Niwa

Created: 2011-08-01 12:33:21 PDT

Size: 4.98 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 92135)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,24 @@
>+2011-08-01  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Search field in designMode causes a crash
>+        https://bugs.webkit.org/show_bug.cgi?id=65362
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The crashed was caused by editing code inadvertently deleting search and cancel buttons in the design mode.
>+        Fixed the bug by overriding user-modify property in shadow root's children by readonly.
>+
>+        This fix is not "correct" in the sense that it will force the shadow root's children to be always not editable
>+        regardless of CSS rules or inline styles. However, due to user-modify being a rare inheritable property,
>+        there is no concise way of overriding it at the shadow boundary.
>+
>+        Test: editing/input/search-field-crash-in-designmode.html
>+
>+        * css/CSSStyleSelector.cpp:
>+        (WebCore::CSSStyleSelector::adjustRenderStyle):
>+        * dom/Node.cpp:
>+        (WebCore::Node::rendererIsEditable):
>+
> 2011-07-28  Abhishek Arya  <inferno@chromium.org>
> 
>         Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
>Index: Source/WebCore/css/CSSStyleSelector.cpp
>===================================================================
>--- Source/WebCore/css/CSSStyleSelector.cpp	(revision 92130)
>+++ Source/WebCore/css/CSSStyleSelector.cpp	(working copy)
>@@ -1933,7 +1933,13 @@ void CSSStyleSelector::adjustRenderStyle
>         style->setTextDecorationsInEffect(style->textDecoration());
>     else
>         style->addToTextDecorationsInEffect(style->textDecoration());
>-    
>+
>+    // FIXME: This forces shadow root's children to be always read only.
>+    // However, applyProperty is not called when inheriting user-modify value for it is a rare inherited data
>+    // and we can't detect whether user-modify is set by style rules or not after the fact.
>+    if (isAtShadowBoundary(e))
>+        style->setUserModify(READ_ONLY);
>+
>     // If either overflow value is not visible, change to auto.
>     if (style->overflowX() == OMARQUEE && style->overflowY() != OMARQUEE)
>         style->setOverflowY(OMARQUEE);
>Index: Source/WebCore/dom/Node.cpp
>===================================================================
>--- Source/WebCore/dom/Node.cpp	(revision 92130)
>+++ Source/WebCore/dom/Node.cpp	(working copy)
>@@ -781,7 +781,7 @@ bool Node::isContentEditable()
> 
> bool Node::rendererIsEditable(EditableLevel editableLevel) const
> {
>-    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable())
>+    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowTreeRootNode())
>         return true;
> 
>     // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 92135)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2011-08-01  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Search field in designMode causes a crash
>+        https://bugs.webkit.org/show_bug.cgi?id=65362
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add a test to ensure WebKit doesn't crash when a user tries to delete inside
>+        an empty search field in the design mode.
>+
>+        * editing/input/search-field-crash-in-designmode-expected.txt: Added.
>+        * editing/input/search-field-crash-in-designmode.html: Added.
>+
> 2011-07-28  Abhishek Arya  <inferno@chromium.org>
> 
>         Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
>Index: LayoutTests/editing/input/search-field-crash-in-designmode-expected.txt
>===================================================================
>--- LayoutTests/editing/input/search-field-crash-in-designmode-expected.txt	(revision 0)
>+++ LayoutTests/editing/input/search-field-crash-in-designmode-expected.txt	(revision 0)
>@@ -0,0 +1,3 @@
>+This test ensures WebKit does not crash when user modifies the contents of search fields in the design mode. WebKit should not crash and you should see PASS below:
>+
>+ PASS
>Index: LayoutTests/editing/input/search-field-crash-in-designmode.html
>===================================================================
>--- LayoutTests/editing/input/search-field-crash-in-designmode.html	(revision 0)
>+++ LayoutTests/editing/input/search-field-crash-in-designmode.html	(revision 0)
>@@ -0,0 +1,20 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<p>This test ensures WebKit does not crash when user modifies the contents of search fields in the design mode.
>+WebKit should not crash and you should see PASS below:</p>
>+<input type="search">
>+<script>
>+
>+if (window.layoutTestController)
>+    layoutTestController.dumpAsText();
>+
>+document.designMode = 'on';
>+document.getElementsByTagName('input')[0].focus();
>+document.execCommand('delete', false, null);
>+
>+document.write('PASS');
>+
>+</script>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 65362: 102544 | 102549