projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 319b9c3)
Crash in in WebCore::EventHandler::mouseMoved.
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jan 2012 00:33:10 +0000 (00:33 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jan 2012 00:33:10 +0000 (00:33 +0000)
https://bugs.webkit.org/show_bug.cgi?id=76462

Reviewed by Ryosuke Niwa.

Source/WebCore:

handleMouseMoveEvent call in EventHandler::mouseMoved can
blow away the frame from underneath. Protect it with a frameview
refptr.

Test: fast/events/mouse-moved-remove-frame-crash.html

* page/EventHandler.cpp:
(WebCore::EventHandler::mouseMoved):

LayoutTests:

* fast/events/mouse-moved-remove-frame-crash-expected.txt: Added.
* fast/events/mouse-moved-remove-frame-crash.html: Added.
* fast/events/resources/mouse-move.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105212 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/events/mouse-moved-remove-frame-crash.html [new file with mode: 0644] patch | blob
LayoutTests/fast/events/resources/mouse-move.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/page/EventHandler.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index e36ce1b..78bc128 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2012-01-17  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in in WebCore::EventHandler::mouseMoved.
+        https://bugs.webkit.org/show_bug.cgi?id=76462
+
+        Reviewed by Ryosuke Niwa.
+
+        * fast/events/mouse-moved-remove-frame-crash-expected.txt: Added.
+        * fast/events/mouse-moved-remove-frame-crash.html: Added.
+        * fast/events/resources/mouse-move.html: Added.
+
 2012-01-17  Alexis Menard  <alexis.menard@openbossa.org>
 
         Increase test coverage for -webkit-border-image.
diff --git a/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt b/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt
new file mode 100644 (file)
index 0000000..7ef22e9
--- /dev/null
+++ b/LayoutTests/fast/events/mouse-moved-remove-frame-crash-expected.txt
@@ -0,0 +1 @@
+PASS
diff --git a/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html b/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html
new file mode 100644 (file)
index 0000000..3b81d08
--- /dev/null
+++ b/LayoutTests/fast/events/mouse-moved-remove-frame-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function onMouseMove()
+{
+    document.body.innerHTML = "PASS";
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function runTest()
+{
+    root = document.getElementById('root').contentDocument;
+    root.addEventListener('mousemove', onMouseMove, 0);
+    eventSender.mouseMoveTo(1, 1);
+    eventSender.mouseMoveTo(0, 0);
+}
+</script>
+<style>body { margin: 0px; }</style>
+<object data="resources/mouse-move.html" id="root" onload="runTest()"></object>
+</html>
diff --git a/LayoutTests/fast/events/resources/mouse-move.html b/LayoutTests/fast/events/resources/mouse-move.html
new file mode 100644 (file)
index 0000000..8a613bf
--- /dev/null
+++ b/LayoutTests/fast/events/resources/mouse-move.html
@@ -0,0 +1,2 @@
+<div id="test"></div><iframe src="#test"></iframe>
+
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 45692a8..7b470bb 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2012-01-17  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in in WebCore::EventHandler::mouseMoved.
+        https://bugs.webkit.org/show_bug.cgi?id=76462
+
+        Reviewed by Ryosuke Niwa.
+
+        handleMouseMoveEvent call in EventHandler::mouseMoved can
+        blow away the frame from underneath. Protect it with a frameview
+        refptr.        
+
+        Test: fast/events/mouse-moved-remove-frame-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::mouseMoved):
+
 2012-01-17  Sam Weinig  <sam@webkit.org>
 
         Add helper macro for forward declaring objective-c classes
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 0a337f8..d42b128 100644 (file)
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1559,6 +1559,8 @@ static RenderLayer* layerForNode(Node* node)
 
 bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
 {
+    RefPtr<FrameView> protector(m_frame->view());
+
     HitTestResult hoveredNode = HitTestResult(LayoutPoint());
     bool result = handleMouseMoveEvent(event, &hoveredNode);
 
Domain: Web Framework / Uncategorized;