Attachment 102549 Details for Bug 65362 – fixes the bug with much less hack

[patch] fixes the bug with much less hack

bug-65362-20110801134022.patch (text/plain), 5.49 KB, created by Ryosuke Niwa on 2011-08-01 13:40:23 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ryosuke Niwa

Created: 2011-08-01 13:40:23 PDT

Size: 5.49 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 92136)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,22 @@
>+2011-08-01  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Search field in designMode causes a crash
>+        https://bugs.webkit.org/show_bug.cgi?id=65362
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The crashed was caused by editing code inadvertently deleting search and cancel buttons in the design mode.
>+        Fixed the bug by avoid inheriting user-modify property from the shadow host.
>+
>+        Test: editing/input/search-field-crash-in-designmode.html
>+
>+        * css/CSSStyleSelector.cpp:
>+        (WebCore::isAtShadowBoundary): Moved.
>+        (WebCore::CSSStyleSelector::styleForElement): Overrides -webkit-user-modify by the initial value after m_style
>+        inherited the values from m_parentStyle but before applying matched rules.
>+        * dom/Node.cpp:
>+        (WebCore::Node::rendererIsEditable): Ignore page's editability inside a shadow DOM.
>+
> 2011-07-28  Abhishek Arya  <inferno@chromium.org>
> 
>         Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
>Index: Source/WebCore/css/CSSStyleSelector.cpp
>===================================================================
>--- Source/WebCore/css/CSSStyleSelector.cpp	(revision 92130)
>+++ Source/WebCore/css/CSSStyleSelector.cpp	(working copy)
>@@ -1299,6 +1299,15 @@ PassRefPtr<RenderStyle> CSSStyleSelector
>     return documentStyle.release();
> }
> 
>+static inline bool isAtShadowBoundary(Element* element)
>+{
>+    if (!element)
>+        return false;
>+
>+    ContainerNode* parentNode = element->parentNode();
>+    return parentNode && parentNode->isShadowRoot();
>+}
>+
> // If resolveForRootDefault is true, style based on user agent style sheet only. This is used in media queries, where
> // relative units are interpreted according to document root element style, styled only with UA stylesheet
> 
>@@ -1353,6 +1362,10 @@ PassRefPtr<RenderStyle> CSSStyleSelector
>         m_style->font().update(0);
>     }
> 
>+    // Don't propagate user-modify into shadow DOM
>+    if (isAtShadowBoundary(e))
>+        m_style->setUserModify(RenderStyle::initialUserModify());
>+
>     if (e->isLink()) {
>         m_style->setIsLink(true);
>         m_style->setInsideLink(m_elementLinkState);
>@@ -1803,15 +1816,6 @@ static void addIntrinsicMargins(RenderSt
>     }
> }
> 
>-static inline bool isAtShadowBoundary(Element* element)
>-{
>-    if (!element)
>-        return false;
>-
>-    ContainerNode* parentNode = element->parentNode();
>-    return parentNode && parentNode->isShadowRoot();
>-}
>-
> void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parentStyle, Element *e)
> {
>     // Cache our original display.
>Index: Source/WebCore/dom/Node.cpp
>===================================================================
>--- Source/WebCore/dom/Node.cpp	(revision 92130)
>+++ Source/WebCore/dom/Node.cpp	(working copy)
>@@ -781,7 +781,7 @@ bool Node::isContentEditable()
> 
> bool Node::rendererIsEditable(EditableLevel editableLevel) const
> {
>-    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable())
>+    if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowTreeRootNode())
>         return true;
> 
>     // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 92135)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2011-08-01  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Search field in designMode causes a crash
>+        https://bugs.webkit.org/show_bug.cgi?id=65362
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add a test to ensure WebKit doesn't crash when a user tries to delete inside
>+        an empty search field in the design mode.
>+
>+        * editing/input/search-field-crash-in-designmode-expected.txt: Added.
>+        * editing/input/search-field-crash-in-designmode.html: Added.
>+
> 2011-07-28  Abhishek Arya  <inferno@chromium.org>
> 
>         Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
>Index: LayoutTests/editing/input/search-field-crash-in-designmode-expected.txt
>===================================================================
>--- LayoutTests/editing/input/search-field-crash-in-designmode-expected.txt	(revision 0)
>+++ LayoutTests/editing/input/search-field-crash-in-designmode-expected.txt	(revision 0)
>@@ -0,0 +1,3 @@
>+This test ensures WebKit does not crash when user modifies the contents of search fields in the design mode. WebKit should not crash and you should see PASS below:
>+
>+ PASS
>Index: LayoutTests/editing/input/search-field-crash-in-designmode.html
>===================================================================
>--- LayoutTests/editing/input/search-field-crash-in-designmode.html	(revision 0)
>+++ LayoutTests/editing/input/search-field-crash-in-designmode.html	(revision 0)
>@@ -0,0 +1,20 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<p>This test ensures WebKit does not crash when user modifies the contents of search fields in the design mode.
>+WebKit should not crash and you should see PASS below:</p>
>+<input type="search">
>+<script>
>+
>+if (window.layoutTestController)
>+    layoutTestController.dumpAsText();
>+
>+document.designMode = 'on';
>+document.getElementsByTagName('input')[0].focus();
>+document.execCommand('delete', false, null);
>+
>+document.write('PASS');
>+
>+</script>
>+</body>
>+</html>

Flags:

dglazkov: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 65362: 102544 | 102549