Attachment 358028 Details for Bug 193012 – Patch

[patch] Patch

bug-193012-20181222173555.patch (text/plain), 5.32 KB, created by zalan on 2018-12-22 17:35:56 PST

(hide)

Description:

Filename:

MIME Type:

Creator: zalan

Created: 2018-12-22 17:35:56 PST

Size: 5.32 KB

patch

obsolete

>Subversion Revision: 239540
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 8ecfee1d2c9f6197df758209640135c8423828f2..9d1ce9d4fa049fb06803051884448beb738131c9 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,21 @@
>+2018-12-22  Zalan Bujtas  <zalan@apple.com>
>+
>+        [Datalist] Crash when input with datalist is cloned.
>+        https://bugs.webkit.org/show_bug.cgi?id=193012
>+        <rdar://problem/45923457>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        WIP patch
>+
>+        Test: fast/forms/datalist/datalist-crash-when-cloned.html
>+
>+        * html/TextFieldInputType.cpp:
>+        (WebCore::TextFieldInputType::createShadowSubtree):
>+        (WebCore::TextFieldInputType::attributeChanged):
>+        (WebCore::TextFieldInputType::createDataListDropdownIndicator):
>+        * html/TextFieldInputType.h:
>+
> 2018-12-22  Carlos Garcia Campos  <cgarcia@igalia.com>
> 
>         [HarfBuzz] Width not correctly reported as 0 for zero font size
>diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
>index a62971353f9fc3bbc71611da74366697175ffa89..f4addb222e48bc056b697af4c23172176fc03577 100644
>--- a/Source/WebCore/html/TextFieldInputType.cpp
>+++ b/Source/WebCore/html/TextFieldInputType.cpp
>@@ -362,9 +362,7 @@ void TextFieldInputType::createShadowSubtree()
>     updateAutoFillButton();
> 
> #if ENABLE(DATALIST_ELEMENT)
>-    m_dataListDropdownIndicator = DataListButtonElement::create(element()->document(), *this);
>-    m_dataListDropdownIndicator->setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone, true);
>-    m_container->appendChild(*m_dataListDropdownIndicator);
>+    createDataListDropdownIndicator();
> #endif
> }
> 
>@@ -427,6 +425,10 @@ void TextFieldInputType::attributeChanged(const QualifiedName& name)
>         if (element())
>             updateInnerTextValue();
>     }
>+#if ENABLE(DATALIST_ELEMENT)
>+    if (name == listAttr && !m_dataListDropdownIndicator)
>+        createDataListDropdownIndicator();
>+#endif
>     InputType::attributeChanged(name);
> }
> 
>@@ -456,6 +458,18 @@ bool TextFieldInputType::shouldUseInputMethod() const
>     return true;
> }
> 
>+#if ENABLE(DATALIST_ELEMENT)
>+void TextFieldInputType::createDataListDropdownIndicator()
>+{
>+    ASSERT(!m_dataListDropdownIndicator);
>+    if (!m_container)
>+        createContainer();
>+    m_dataListDropdownIndicator = DataListButtonElement::create(element()->document(), *this);
>+    m_dataListDropdownIndicator->setInlineStyleProperty(CSSPropertyDisplay, element()->list() ? CSSValueBlock : CSSValueNone, true);
>+    m_container->appendChild(*m_dataListDropdownIndicator);
>+}
>+#endif
>+
> // FIXME: The name of this function doesn't make clear the two jobs it does:
> // 1) Limits the string to a particular number of grapheme clusters.
> // 2) Truncates the string at the first character which is a control character other than tab.
>diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h
>index 291f8fbc74c9ce1e7a6eabf37263b867831fa1e9..2ffa7b2921aaa6ef1c90e64987b5c893db7c93fa 100644
>--- a/Source/WebCore/html/TextFieldInputType.h
>+++ b/Source/WebCore/html/TextFieldInputType.h
>@@ -124,6 +124,7 @@ private:
>     void createAutoFillButton(AutoFillButtonType);
> 
> #if ENABLE(DATALIST_ELEMENT)
>+    void createDataListDropdownIndicator();
>     bool isPresentingAttachedView() const final;
>     void listAttributeTargetChanged() final;
>     void displaySuggestions(DataListSuggestionActivationType);
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index e5eae5bf9980c0035f1d515f5bb209f5d0ce53a7..802318f0809535fe5659369ca654807bd4ef42d5 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,14 @@
>+2018-12-22  Zalan Bujtas  <zalan@apple.com>
>+
>+        [Datalist] Crash when input with datalist is cloned.
>+        https://bugs.webkit.org/show_bug.cgi?id=193012
>+        <rdar://problem/45923457>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/forms/datalist/datalist-crash-when-cloned-expected.txt: Added.
>+        * fast/forms/datalist/datalist-crash-when-cloned.html: Added.
>+
> 2018-12-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         [JSC] Implement "well-formed JSON.stringify" proposal
>diff --git a/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned-expected.txt b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..98528afa0c31f2d37260e0e53168739c12a84fe1
>--- /dev/null
>+++ b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned-expected.txt
>@@ -0,0 +1,2 @@
>+Pass if no crash or assert
>+  
>diff --git a/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned.html b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..4bf8f3ae6ce0869c658426307eb6e831e55460ce
>--- /dev/null
>+++ b/LayoutTests/fast/forms/datalist/datalist-crash-when-cloned.html
>@@ -0,0 +1,15 @@
>+<div>Pass if no crash or assert</div>
>+<input list="ice-cream-flavors" id="ice" name="ice-cream-choice">
>+<datalist id="ice-cream-flavors">
>+    <option value="Chocolate">
>+    </option><option value="Coconut">
>+    </option><option value="Mint">
>+	</option>
>+</datalist>
>+
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+document.body.offsetHeight;
>+document.body.appendChild(ice.cloneNode());
>+</script>

Actions: View | Formatted Diff | Diff

Attachments on bug 193012: 358028 | 358070 | 358072 | 358189 | 358208