WebKit Bugzilla
Attachment 358028 Details for
Bug 193012
: [Datalist] Crash when input with datalist is dynamically added.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-193012-20181222173555.patch (text/plain), 5.32 KB, created by
zalan
on 2018-12-22 17:35:56 PST
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
zalan
Created:
2018-12-22 17:35:56 PST
Size:
5.32 KB
patch
obsolete
>Subversion Revision: 239540 >diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog >index 8ecfee1d2c9f6197df758209640135c8423828f2..9d1ce9d4fa049fb06803051884448beb738131c9 100644 >--- a/Source/WebCore/ChangeLog >+++ b/Source/WebCore/ChangeLog >@@ -1,3 +1,21 @@ >+2018-12-22 Zalan Bujtas <zalan@apple.com> >+ >+ [Datalist] Crash when input with datalist is cloned. >+ https://bugs.webkit.org/show_bug.cgi?id=193012 >+ <rdar://problem/45923457> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ WIP patch >+ >+ Test: fast/forms/datalist/datalist-crash-when-cloned.html >+ >+ * html/TextFieldInputType.cpp: >+ (WebCore::TextFieldInputType::createShadowSubtree): >+ (WebCore::TextFieldInputType::attributeChanged): >+ (WebCore::TextFieldInputType::createDataListDropdownIndicator): >+ * html/TextFieldInputType.h: >+ > 2018-12-22 Carlos Garcia Campos <cgarcia@igalia.com> > > [HarfBuzz] Width not correctly reported as 0 for zero font size >diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp >index a62971353f9fc3bbc71611da74366697175ffa89..f4addb222e48bc056b697af4c23172176fc03577 100644 >--- a/Source/WebCore/html/TextFieldInputType.cpp >+++ b/Source/WebCore/html/TextFieldInputType.cpp >@@ -362,9 +362,7 @@ void TextFieldInputType::createShadowSubtree() > updateAutoFillButton(); > > #if ENABLE(DATALIST_ELEMENT) >- m_dataListDropdownIndicator = DataListButtonElement::create(element()->document(), *this); >- m_dataListDropdownIndicator->setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone, true); >- m_container->appendChild(*m_dataListDropdownIndicator); >+ createDataListDropdownIndicator(); > #endif > } > >@@ -427,6 +425,10 @@ void TextFieldInputType::attributeChanged(const QualifiedName& name) > if (element()) > updateInnerTextValue(); > } >+#if ENABLE(DATALIST_ELEMENT) >+ if (name == listAttr && !m_dataListDropdownIndicator) >+ createDataListDropdownIndicator(); >+#endif > InputType::attributeChanged(name); > } > >@@ -456,6 +458,18 @@ bool TextFieldInputType::shouldUseInputMethod() const > return true; > } > >+#if ENABLE(DATALIST_ELEMENT) >+void TextFieldInputType::createDataListDropdownIndicator() >+{ >+ ASSERT(!m_dataListDropdownIndicator); >+ if (!m_container) >+ createContainer(); >+ m_dataListDropdownIndicator = DataListButtonElement::create(element()->document(), *this); >+ m_dataListDropdownIndicator->setInlineStyleProperty(CSSPropertyDisplay, element()->list() ? CSSValueBlock : CSSValueNone, true); >+ m_container->appendChild(*m_dataListDropdownIndicator); >+} >+#endif >+ > // FIXME: The name of this function doesn't make clear the two jobs it does: > // 1) Limits the string to a particular number of grapheme clusters. > // 2) Truncates the string at the first character which is a control character other than tab. >diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h >index 291f8fbc74c9ce1e7a6eabf37263b867831fa1e9..2ffa7b2921aaa6ef1c90e64987b5c893db7c93fa 100644 >--- a/Source/WebCore/html/TextFieldInputType.h >+++ b/Source/WebCore/html/TextFieldInputType.h >@@ -124,6 +124,7 @@ private: > void createAutoFillButton(AutoFillButtonType); > > #if ENABLE(DATALIST_ELEMENT) >+ void createDataListDropdownIndicator(); > bool isPresentingAttachedView() const final; > void listAttributeTargetChanged() final; > void displaySuggestions(DataListSuggestionActivationType); >diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog >index e5eae5bf9980c0035f1d515f5bb209f5d0ce53a7..802318f0809535fe5659369ca654807bd4ef42d5 100644 >--- a/LayoutTests/ChangeLog >+++ b/LayoutTests/ChangeLog >@@ -1,3 +1,14 @@ >+2018-12-22 Zalan Bujtas <zalan@apple.com> >+ >+ [Datalist] Crash when input with datalist is cloned. >+ https://bugs.webkit.org/show_bug.cgi?id=193012 >+ <rdar://problem/45923457> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * fast/forms/datalist/datalist-crash-when-cloned-expected.txt: Added. >+ * fast/forms/datalist/datalist-crash-when-cloned.html: Added. >+ > 2018-12-20 Yusuke Suzuki <yusukesuzuki@slowstart.org> > > [JSC] Implement "well-formed JSON.stringify" proposal >diff --git a/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned-expected.txt b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned-expected.txt >new file mode 100644 >index 0000000000000000000000000000000000000000..98528afa0c31f2d37260e0e53168739c12a84fe1 >--- /dev/null >+++ b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned-expected.txt >@@ -0,0 +1,2 @@ >+Pass if no crash or assert >+ >diff --git a/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned.html b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned.html >new file mode 100644 >index 0000000000000000000000000000000000000000..4bf8f3ae6ce0869c658426307eb6e831e55460ce >--- /dev/null >+++ b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned.html >@@ -0,0 +1,15 @@ >+<div>Pass if no crash or assert</div> >+<input list="ice-cream-flavors" id="ice" name="ice-cream-choice"> >+<datalist id="ice-cream-flavors"> >+ <option value="Chocolate"> >+ </option><option value="Coconut"> >+ </option><option value="Mint"> >+ </option> >+</datalist> >+ >+<script> >+if (window.testRunner) >+ testRunner.dumpAsText(); >+document.body.offsetHeight; >+document.body.appendChild(ice.cloneNode()); >+</script>
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 193012
:
358028
|
358070
|
358072
|
358189
|
358208