52065 2011-01-07 09:23:15 -0800 REGRESSION(r71934): Shadow DOM nodes leak via relatedTarget 2011-02-23 15:50:19 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED http://jsfiddle.net/qs9f2/ P2 Normal --- 54025 46015 1 jvingiano dglazkov abarth ap commit-queue dglazkov eric priyajeet.hora temp01irc+bugzilla webkit.review.bot oldest_to_newest 330803 0 jvingiano 2011-01-07 09:23:15 -0800 Other browsers tested: Safari 5.0.3: OK Firefox 3.6.13: OK Opera 10.63: OK Opera 11: OK Rockmelt 0.8.40.147: OK What steps will reproduce the problem? 1. Create a div with an <input> as a child element. 2. Attach a mouseenter/leave event to this div. 3. Chrome will see a mouse over of the child input as a mouseleave event, even though it is a child of the parent <div> What is the expected result? Expected that Chrome will not consider mousing over the child <input> field as a mouseleave event of the parent div. What happens instead? Chrome considers the mousing over the child <input> as a mouseleave event even though it is not. Please provide any additional information below. Attach a screenshot if possible. http://jsfiddle.net/qs9f2/ http://bugs.jquery.com/ticket/7729 331173 1 priyajeet.hora 2011-01-08 00:18:01 -0800 This bug applies to all platforms btw. 331193 2 jvingiano 2011-01-08 07:53:10 -0800 (In reply to comment #1) > This bug applies to all platforms btw. Figured but I couldn't test on any other platform so I didn't want to speak too soon. Will change it, thanks for testing. 334566 3 priyajeet.hora 2011-01-14 13:40:19 -0800 Another site that seems to be exhibiting this issue http://www.movietickets.com/default.asp Mouse over the choose your movie box in the center top. This will open up a overlay div that has an input box, mouse over the input box and you will see the overlay disappears. 346748 4 jvingiano 2011-02-07 13:04:57 -0800 Another realworld example of this bug has been pointed out at http://www.desiringgod.org After hovering over the sign-in link, a field will appear with input fields. Hovering over an input field will hide the whole div, which is unexpected UX and does not happen in non-Webkit browsers. 347425 5 dglazkov 2011-02-08 09:04:41 -0800 Whoopsie. 347459 6 dglazkov 2011-02-08 09:41:07 -0800 Here's the reduction: http://jsfiddle.net/dglazkov/qs9f2/20/ 347617 7 81679 dglazkov 2011-02-08 13:02:46 -0800 Created attachment 81679 Patch 347636 8 81679 darin 2011-02-08 13:22:51 -0800 Comment on attachment 81679 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > Source/WebCore/dom/Node.cpp:2876 > - RefPtr<Node> relatedTarget = relatedTargetArg; > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? 347668 9 dglazkov 2011-02-08 14:13:06 -0800 (In reply to comment #8) > (From update of attachment 81679 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > > > Source/WebCore/dom/Node.cpp:2876 > > - RefPtr<Node> relatedTarget = relatedTargetArg; > > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); > > Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? The relatedTarget only needs to move if we have (In reply to comment #8) > (From update of attachment 81679 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > > > Source/WebCore/dom/Node.cpp:2876 > > - RefPtr<Node> relatedTarget = relatedTargetArg; > > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); > > Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? This is not the best or final solution, but it's enough to stop the leaks and won't exhibit gross side effects in the current uses of shadow DOM. The event will either be stopped if the relatedTarget is inside of the same shadow boundary as target or retargeted to the boundary that's closest to the target. Doing this without DOM scopes (see bug 52963) is possible but super-tedious. 347674 10 dglazkov 2011-02-08 14:15:29 -0800 (In reply to comment #9) > (In reply to comment #8) > > (From update of attachment 81679 [details] [details]) > > View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > > > > > Source/WebCore/dom/Node.cpp:2876 > > > - RefPtr<Node> relatedTarget = relatedTargetArg; > > > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); > > > > Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? > > The relatedTarget only needs to move if we have (In reply to comment #8) > > (From update of attachment 81679 [details] [details]) > > View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > > > > > Source/WebCore/dom/Node.cpp:2876 > > > - RefPtr<Node> relatedTarget = relatedTargetArg; > > > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); > > > > Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? > > This is not the best or final solution, but it's enough to stop the leaks and won't exhibit gross side effects in the current uses of shadow DOM. > > The event will either be stopped if the relatedTarget is inside of the same shadow boundary as target or retargeted to the boundary that's closest to the target. Doing this without DOM scopes (see bug 52963) is possible but super-tedious. Oh wow, I clearly over-edited this :) The last paragraph describes the proper solution. 347970 11 81679 commit-queue 2011-02-08 21:56:03 -0800 Comment on attachment 81679 Patch Rejecting attachment 81679 from commit-queue. Failed to run "['./Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=cr-jail-8', 'build-..." exit_code: 2 Last 500 characters of output: ng/hebrew ....... fast/events ........................................................................................................................................................................................................................................ fast/events/shadow-boundary-crossing.html -> failed Exiting early after 1 failures. 8052 tests run. 170.56s total testing time 8051 test cases (99%) succeeded 1 test case (<1%) had incorrect layout 4 test cases (<1%) had stderr output Full output: http://queues.webkit.org/results/7791271 347978 12 dglazkov 2011-02-08 22:05:08 -0800 Ah. I should really update results foist. :) 348339 13 dglazkov 2011-02-09 10:03:46 -0800 Committed r78077: <http://trac.webkit.org/changeset/78077> 348512 14 webkit.review.bot 2011-02-09 13:23:33 -0800 http://trac.webkit.org/changeset/78077 might have broken GTK Linux 64-bit Debug 356506 15 dglazkov 2011-02-23 15:50:19 -0800 (In reply to comment #10) > (In reply to comment #9) > > (In reply to comment #8) > > > (From update of attachment 81679 [details] [details] [details]) > > > View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > > > > > > > Source/WebCore/dom/Node.cpp:2876 > > > > - RefPtr<Node> relatedTarget = relatedTargetArg; > > > > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); > > > > > > Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? > > > > The relatedTarget only needs to move if we have (In reply to comment #8) > > > (From update of attachment 81679 [details] [details] [details]) > > > View in context: https://bugs.webkit.org/attachment.cgi?id=81679&action=review > > > > > > > Source/WebCore/dom/Node.cpp:2876 > > > > - RefPtr<Node> relatedTarget = relatedTargetArg; > > > > + RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg); > > > > > > Is there really just one level or this? Doesn’t the event travel out of multiple layers of shadow, each time needing a different relatedTarget? > > > > This is not the best or final solution, but it's enough to stop the leaks and won't exhibit gross side effects in the current uses of shadow DOM. > > > > The event will either be stopped if the relatedTarget is inside of the same shadow boundary as target or retargeted to the boundary that's closest to the target. Doing this without DOM scopes (see bug 52963) is possible but super-tedious. > > Oh wow, I clearly over-edited this :) > > The last paragraph describes the proper solution. ... and it turns out I need it sooner than I thought. 81679 2011-02-08 13:02:46 -0800 2011-02-08 21:56:03 -0800 Patch bug-52065-20110208130245.patch text/plain 4798 dglazkov U3VidmVyc2lvbiBSZXZpc2lvbjogNzc5NTgKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA2N2Y2ZmZhYjZkODdkNjg4MTA5Yjdh OTIwMmJkMWRhZmMwOTc1MzI2Li41YjAyNmJlNzA0NTMwNjZiNmY5ZDU0ZTY3NjA4NDcxZDFiNjlh YjIxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTIgQEAKKzIwMTEtMDItMDggIERpbWl0cmkgR2xhemtvdiAg PGRnbGF6a292QGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBSRUdSRVNTSU9OKHI3MTkzNCk6IFNoYWRvdyBET00gbm9kZXMgbGVh ayB2aWEgcmVsYXRlZFRhcmdldAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9NTIwNjUKKworICAgICAgICAqIGZhc3QvZXZlbnRzL3NoYWRvdy1ib3VuZGFy eS1jcm9zc2luZy5odG1sOiBBZGRlZCByZWxhdGVkVGFyZ2V0IHJldGFyZ2V0aW5nIHRlc3QuCisK IDIwMTEtMDItMDggIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAg ICAgICAgUmV2aWV3ZWQgYnkgRGFuIEJlcm5zdGVpbi4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz L2Zhc3QvZXZlbnRzL3NoYWRvdy1ib3VuZGFyeS1jcm9zc2luZy5odG1sIGIvTGF5b3V0VGVzdHMv ZmFzdC9ldmVudHMvc2hhZG93LWJvdW5kYXJ5LWNyb3NzaW5nLmh0bWwKaW5kZXggNGU4NDg2YjJi ZTY5ODEyYzA2OTE3MzU0MjlmMzhkMTc1OWZjZmVlMi4uY2ZjNGE3MjE3M2QzZGY2NzE3NzkzMmQx OWZjZjdlYWQwNTVhYmI2NSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvZmFzdC9ldmVudHMvc2hh ZG93LWJvdW5kYXJ5LWNyb3NzaW5nLmh0bWwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9ldmVudHMv c2hhZG93LWJvdW5kYXJ5LWNyb3NzaW5nLmh0bWwKQEAgLTksNyArOSw3IEBAIGZ1bmN0aW9uIGxv Zyhtc2csIHN1Y2Nlc3MpCiAgICAgbG9nRGl2LmFwcGVuZENoaWxkKGRvY3VtZW50LmNyZWF0ZUVs ZW1lbnQoJ2RpdicpKS50ZXh0Q29udGVudCA9IG1zZyArICc6ICcgKyAoc3VjY2VzcyA/ICdQQVNT JyA6ICdGQUlMJyk7CiB9CiAKLWZ1bmN0aW9uIGNsaWNrT24oZWxlbWVudCkKK2Z1bmN0aW9uIG1v dmVPdmVyKGVsZW1lbnQpCiB7CiAgICAgaWYgKCF3aW5kb3cuZXZlbnRTZW5kZXIpCiAgICAgICAg IHJldHVybjsKQEAgLTE3LDYgKzE3LDExIEBAIGZ1bmN0aW9uIGNsaWNrT24oZWxlbWVudCkKICAg ICB2YXIgeCA9IGVsZW1lbnQub2Zmc2V0TGVmdCArIGVsZW1lbnQub2Zmc2V0V2lkdGggLyAyOwog ICAgIHZhciB5ID0gZWxlbWVudC5vZmZzZXRUb3AgKyBlbGVtZW50Lm9mZnNldEhlaWdodCAvIDI7 CiAgICAgZXZlbnRTZW5kZXIubW91c2VNb3ZlVG8oeCwgeSk7Cit9CisKK2Z1bmN0aW9uIGNsaWNr T24oZWxlbWVudCkKK3sKKyAgICBtb3ZlT3ZlcihlbGVtZW50KTsKICAgICBldmVudFNlbmRlci5t b3VzZURvd24oKTsKICAgICBldmVudFNlbmRlci5tb3VzZVVwKCk7CiB9CkBAIC0xMDAsNiArMTA1 LDIyIEBAIHZhciB0ZXN0cyA9IHsKICAgICAgICAgZG9jdW1lbnQuYm9keS5yZW1vdmVFdmVudExp c3RlbmVyKCdET01BY3RpdmF0ZScsIGNvdW50ZXIsIGZhbHNlKTsKICAgICAgICAgZmlsZUlucHV0 LnBhcmVudE5vZGUucmVtb3ZlQ2hpbGQoZmlsZUlucHV0KTsKICAgICB9LAorICAgIHJlbGF0ZWRU YXJnZXRSZXRhcmdldGluZzogZnVuY3Rpb24oKQorICAgIHsKKyAgICAgICAgdmFyIGNvdW50ID0g MDsKKyAgICAgICAgdmFyIHRleHRJbnB1dCA9IGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoZG9j dW1lbnQuY3JlYXRlRWxlbWVudCgnaW5wdXQnKSk7CisgICAgICAgIHZhciBjb3VudGVyID0gZnVu Y3Rpb24oZXZ0KQorICAgICAgICB7CisgICAgICAgICAgICBpZiAoZXZ0LnJlbGF0ZWRUYXJnZXQg JiYgIWV2dC5yZWxhdGVkVGFyZ2V0LnBhcmVudE5vZGUpCisgICAgICAgICAgICAgICAgY291bnQr KzsKKyAgICAgICAgfQorICAgICAgICBkb2N1bWVudC5ib2R5LmFkZEV2ZW50TGlzdGVuZXIoIm1v dXNlb3ZlciIsIGNvdW50ZXIsIGZhbHNlKTsKKyAgICAgICAgbW92ZU92ZXIodGV4dElucHV0KTsK KyAgICAgICAgbW92ZU92ZXIoZG9jdW1lbnQuYm9keSk7CisgICAgICAgIGRvY3VtZW50LmJvZHku cmVtb3ZlRXZlbnRMaXN0ZW5lcigibW91c2VvdmVyIiwgY291bnRlciwgZmFsc2UpOworICAgICAg ICBsb2coIkV2ZW50J3MgcmVsYXRlZFRhcmdldCBzaG91bGQgYmUgcmV0YXJnZXRlZCIsIGNvdW50 ID09IDApOworICAgICAgICB0ZXh0SW5wdXQucGFyZW50Tm9kZS5yZW1vdmVDaGlsZCh0ZXh0SW5w dXQpOworICAgIH0sCiAgICAgZXZlbnRJblByb2dyZXNzOiBmdW5jdGlvbigpCiAgICAgewogICAg ICAgICB2YXIgdGV4dElucHV0ID0gZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChkb2N1bWVudC5j cmVhdGVFbGVtZW50KCdpbnB1dCcpKTsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCBmNjVkM2I5NWQ5MWQzYThiMDA0 ZDYzMDNlY2M3ZDU2NmQ5ODM0ZWFlLi5kMWRiNTI1OTRlN2I2OGZkYjIzOTNjZmE2OTdhNmE2Yzlk NzY0YWY1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNl L1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTEtMDItMDggIERpbWl0cmkg R2xhemtvdiAgPGRnbGF6a292QGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBSRUdSRVNTSU9OKHI3MTkzNCk6IFNoYWRvdyBET00g bm9kZXMgbGVhayB2aWEgcmVsYXRlZFRhcmdldAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTIwNjUKKworICAgICAgICAqIGRvbS9Ob2RlLmNwcDoKKyAg ICAgICAgKFdlYkNvcmU6OnB1bGxPdXRPZlNoYWRvdyk6IEFkZGVkIGEgaGVscGVyIHRvIG1vdmUg YSBub2RlIHRvIHRoZSBvdXRlcm1vc3QKKyAgICAgICAgICAgIGJvdW5kYXJ5IG9mIHNoYWRvdyBE T00uCisgICAgICAgIChXZWJDb3JlOjpOb2RlOjpkaXNwYXRjaE1vdXNlRXZlbnQpOiBDaGFuZ2Vk IHRvIHVzZSBwdWxsT3V0T2ZTaGFkb3cuCisKIDIwMTEtMDItMDggIFNpbW9uIEZyYXNlciAgPHNp bW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFuIEJlcm5zdGVp bi4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2RvbS9Ob2RlLmNwcCBiL1NvdXJjZS9XZWJD b3JlL2RvbS9Ob2RlLmNwcAppbmRleCBmZWMyY2ZmZTYzN2Y5OWZiNTFmZWJkYjQ5Y2U2NmYwNTlm Yzk2NWY3Li5iMDI5YTc1ZGVhMTU1NGMxY2IwNzUwZjY2MzIyOTJjZGQwYTQzYTVjIDEwMDY0NAot LS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vTm9kZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZG9t L05vZGUuY3BwCkBAIC0yODM5LDYgKzI4MzksMTggQEAgdm9pZCBOb2RlOjpkaXNwYXRjaFNpbXVs YXRlZENsaWNrKFBhc3NSZWZQdHI8RXZlbnQ+IGV2ZW50LCBib29sIHNlbmRNb3VzZUV2ZW50cywK ICAgICBnTm9kZXNEaXNwYXRjaGluZ1NpbXVsYXRlZENsaWNrcy0+cmVtb3ZlKHRoaXMpOwogfQog CisvLyBGSVhNRTogT25jZSBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 NTI5NjMgbGFuZHMsIHRoaXMgc2hvdWxkCisvLyBiZSBncmVhdGx5IGltcHJvdmVkLiBTZWUgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU0MDI1Lgorc3RhdGljIE5vZGUq IHB1bGxPdXRPZlNoYWRvdyhOb2RlKiBub2RlKQoreworICAgIE5vZGUqIG91dGVybW9zdFNoYWRv d0JvdW5kYXJ5ID0gbm9kZTsKKyAgICBmb3IgKE5vZGUqIG4gPSBub2RlOyBuOyBuID0gbi0+cGFy ZW50T3JIb3N0Tm9kZSgpKSB7CisgICAgICAgIGlmIChuLT5pc1NoYWRvd1Jvb3QoKSkKKyAgICAg ICAgICAgIG91dGVybW9zdFNoYWRvd0JvdW5kYXJ5ID0gbi0+cGFyZW50T3JIb3N0Tm9kZSgpOwor ICAgIH0KKyAgICByZXR1cm4gb3V0ZXJtb3N0U2hhZG93Qm91bmRhcnk7Cit9CisKIGJvb2wgTm9k ZTo6ZGlzcGF0Y2hNb3VzZUV2ZW50KGNvbnN0IEF0b21pY1N0cmluZyYgZXZlbnRUeXBlLCBpbnQg YnV0dG9uLCBpbnQgZGV0YWlsLAogICAgIGludCBwYWdlWCwgaW50IHBhZ2VZLCBpbnQgc2NyZWVu WCwgaW50IHNjcmVlblksCiAgICAgYm9vbCBjdHJsS2V5LCBib29sIGFsdEtleSwgYm9vbCBzaGlm dEtleSwgYm9vbCBtZXRhS2V5LCAKQEAgLTI4NjEsNyArMjg3Myw3IEBAIGJvb2wgTm9kZTo6ZGlz cGF0Y2hNb3VzZUV2ZW50KGNvbnN0IEF0b21pY1N0cmluZyYgZXZlbnRUeXBlLCBpbnQgYnV0dG9u LCBpbnQgZGV0CiAgICAgYm9vbCBzd2FsbG93RXZlbnQgPSBmYWxzZTsKICAgICAKICAgICAvLyBB dHRlbXB0aW5nIHRvIGRpc3BhdGNoIHdpdGggYSBub24tRXZlbnRUYXJnZXQgcmVsYXRlZFRhcmdl dCBjYXVzZXMgdGhlIHJlbGF0ZWRUYXJnZXQgdG8gYmUgc2lsZW50bHkgaWdub3JlZC4KLSAgICBS ZWZQdHI8Tm9kZT4gcmVsYXRlZFRhcmdldCA9IHJlbGF0ZWRUYXJnZXRBcmc7CisgICAgUmVmUHRy PE5vZGU+IHJlbGF0ZWRUYXJnZXQgPSBwdWxsT3V0T2ZTaGFkb3cocmVsYXRlZFRhcmdldEFyZyk7 CiAKICAgICBpbnQgYWRqdXN0ZWRQYWdlWCA9IHBhZ2VYOwogICAgIGludCBhZGp1c3RlZFBhZ2VZ ID0gcGFnZVk7Cg==