Attachment 346869 Details for Bug 188410 – Patch

[patch] Patch

bug-188410-20180809160224.patch (text/plain), 3.43 KB, created by Chris Dumez on 2018-08-09 16:02:24 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2018-08-09 16:02:24 PDT

Size: 3.43 KB

patch

obsolete

>Subversion Revision: 234736
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 994a0560fbed876db99b3c2467c2feac27e8ba24..9c1380aa0a6d931bdcc5722c144a33a612822349 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,21 @@
>+2018-08-09  Chris Dumez  <cdumez@apple.com>
>+
>+        InputType should not interact with an HTMLInputElement is no longer associated with
>+        https://bugs.webkit.org/show_bug.cgi?id=188410
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Clear InputType::m_element when the InputType is no longer associated with the HTMLInputElement
>+        because the element changed type. We were already dealing with the InputType no longer being
>+        associated with an element because the element died by using a WeakPtr. However, it is conceptually
>+        better (more correct) to also clear this pointer if the element is still alive but associated with
>+        another InputType.
>+
>+        * html/HTMLInputElement.cpp:
>+        (WebCore::HTMLInputElement::updateType):
>+        * html/InputType.h:
>+        (WebCore::InputType::detachFromElement):
>+
> 2018-08-09  Saam Barati  <sbarati@apple.com>
> 
>         memoryFootprint should return size_t not optional<size_t>
>diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
>index b1ff12d96a59fdb4d13d01144245a32c8113cebb..dc5aa3d882abdd8f46157d7ef75ce7b0bfbd548c 100644
>--- a/Source/WebCore/html/HTMLInputElement.cpp
>+++ b/Source/WebCore/html/HTMLInputElement.cpp
>@@ -521,6 +521,7 @@ void HTMLInputElement::updateType()
>     }
> 
>     m_inputType->destroyShadowSubtree();
>+    m_inputType->detachFromElement();
> 
>     m_inputType = WTFMove(newType);
>     m_inputType->createShadowSubtree();
>diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
>index c994cce523cc86b66ce9ea8023847063629b2e8d..fe2a40b0b4f3c14635b7f9a0ffa33cf6bb934928 100644
>--- a/Source/WebCore/html/InputType.h
>+++ b/Source/WebCore/html/InputType.h
>@@ -77,6 +77,8 @@ public:
>     static Ref<InputType> createText(HTMLInputElement&);
>     virtual ~InputType();
> 
>+    void detachFromElement() { m_element = nullptr; }
>+
>     static bool themeSupportsDataListUI(InputType*);
> 
>     virtual const AtomicString& formControlType() const = 0;
>@@ -314,7 +316,7 @@ private:
>     // Helper for stepUp()/stepDown(). Adds step value * count to the current value.
>     ExceptionOr<void> applyStep(int count, AnyStepHandling, TextFieldEventBehavior);
> 
>-    // Raw pointer because the HTMLInputElement object owns this InputType object.
>+    // m_element is null if this InputType is no longer associated with an element (either the element died or changed input type).
>     WeakPtr<HTMLInputElement> m_element;
> };
> 
>diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
>index 4460d71982d67b6f3c80f419c83fbc31c9c87fa0..995fcf213447ba597b5b7e66d59e3ec14aead970 100644
>--- a/Source/WebCore/html/RangeInputType.cpp
>+++ b/Source/WebCore/html/RangeInputType.cpp
>@@ -321,8 +321,8 @@ void RangeInputType::accessKeyAction(bool sendMouseEvents)
> {
>     InputType::accessKeyAction(sendMouseEvents);
> 
>-    ASSERT(element());
>-    element()->dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
>+    if (auto* element = this->element())
>+        element->dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
> }
> 
> void RangeInputType::attributeChanged(const QualifiedName& name)

Actions: View | Formatted Diff | Diff

Attachments on bug 188410: 346785 | 346867 | 346869