projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: aa320ec)
Crash in EventHandler::updateDragAndDrop
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 1 Feb 2012 21:34:08 +0000 (21:34 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 1 Feb 2012 21:34:08 +0000 (21:34 +0000)
https://bugs.webkit.org/show_bug.cgi?id=77569

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test: fast/events/remove-target-with-shadow-in-drag.html

* page/EventHandler.cpp:
(WebCore::EventHandler::updateDragAndDrop):

LayoutTests:

* fast/events/remove-target-with-shadow-in-drag-expected.txt: Added.
* fast/events/remove-target-with-shadow-in-drag.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@106488 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/events/remove-target-with-shadow-in-drag.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/page/EventHandler.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index f003302..87f1c63 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2012-02-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in EventHandler::updateDragAndDrop
+        https://bugs.webkit.org/show_bug.cgi?id=77569
+
+        Reviewed by Alexey Proskuryakov.
+
+        * fast/events/remove-target-with-shadow-in-drag-expected.txt: Added.
+        * fast/events/remove-target-with-shadow-in-drag.html: Added.
+
 2012-02-01  Szilard Ledan  <Ledan-Muntean.Szilard@stud.u-szeged.hu>
 
         Fixed some lines in the date-constructor.js test.
diff --git a/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt b/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt
new file mode 100644 (file)
index 0000000..219168e
--- /dev/null
+++ b/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: line 34: NOT_FOUND_ERR: DOM Exception 8: An attempt was made to reference a Node in a context where it does not exist.
+CONSOLE MESSAGE: line 34: NOT_FOUND_ERR: DOM Exception 8: An attempt was made to reference a Node in a context where it does not exist.
+PASS. DRT didn't crash.
diff --git a/LayoutTests/fast/events/remove-target-with-shadow-in-drag.html b/LayoutTests/fast/events/remove-target-with-shadow-in-drag.html
new file mode 100644 (file)
index 0000000..8a968f1
--- /dev/null
+++ b/LayoutTests/fast/events/remove-target-with-shadow-in-drag.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+
+if (!window.layoutTestController)
+    document.writeln("This crash test needs to be ran inside DumpRenderTree");
+
+var target;
+
+function startTest() {
+    if (!window.layoutTestController)
+        return;
+
+    layoutTestController.dumpAsText();
+
+    function mouseMoveToCenterOfElement(element) {
+        eventSender.mouseMoveTo(element.offsetLeft + element.offsetWidth / 2, element.offsetTop + element.offsetHeight / 2);
+    }
+
+    var src = document.getElementById('src');
+    mouseMoveToCenterOfElement(src);
+    eventSender.mouseDown();
+    eventSender.leapForward(200);
+
+    target = document.getElementById('target');
+    eventSender.mouseMoveTo(target.offsetLeft + 5, target.offsetTop + 5);
+    eventSender.mouseUp();
+
+    document.body.innerHTML = "PASS. DRT didn't crash."
+}
+
+function trigger() {
+    document.body.removeChild(target);
+    target = null;
+    if (window.GCController)
+        GCController.collect();
+}
+
+</script>
+<img id="src" src="resources/abe.png" onload="startTest()" draggable="true" ondrag="trigger();">
+<textarea id="target" style="width: 500px; height: 500px;">Dropzone</textarea>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 232925e..9012d6c 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2012-02-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in EventHandler::updateDragAndDrop
+        https://bugs.webkit.org/show_bug.cgi?id=77569
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: fast/events/remove-target-with-shadow-in-drag.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
 2012-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r106382.
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 2fe8f04..4ab1833 100644 (file)
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1837,7 +1837,7 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
     MouseEventWithHitTestResults mev = prepareMouseEvent(request, event);
 
     // Drag events should never go to text nodes (following IE, and proper mouseover/out dispatch)
-    Node* newTarget = targetNode(mev);
+    RefPtr<Node> newTarget = targetNode(mev);
     if (newTarget && newTarget->isTextNode())
         newTarget = newTarget->parentNode();
     if (newTarget)
@@ -1850,7 +1850,7 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         //
         // Moreover, this ordering conforms to section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>.
         Frame* targetFrame;
-        if (targetIsFrame(newTarget, targetFrame)) {
+        if (targetIsFrame(newTarget.get(), targetFrame)) {
             if (targetFrame)
                 accept = targetFrame->eventHandler()->updateDragAndDrop(event, clipboard);
         } else if (newTarget) {
@@ -1859,9 +1859,9 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
                 // for now we don't care if event handler cancels default behavior, since there is none
                 dispatchDragSrcEvent(eventNames().dragEvent, event);
             }
-            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
+            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget.get(), event, clipboard);
             if (!accept)
-                accept = findDropZone(newTarget, clipboard);
+                accept = findDropZone(newTarget.get(), clipboard);
         }
 
         if (targetIsFrame(m_dragTarget.get(), targetFrame)) {
@@ -1877,7 +1877,7 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         }
     } else {
         Frame* targetFrame;
-        if (targetIsFrame(newTarget, targetFrame)) {
+        if (targetIsFrame(newTarget.get(), targetFrame)) {
             if (targetFrame)
                 accept = targetFrame->eventHandler()->updateDragAndDrop(event, clipboard);
         } else if (newTarget) {
@@ -1886,9 +1886,9 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
                 // for now we don't care if event handler cancels default behavior, since there is none
                 dispatchDragSrcEvent(eventNames().dragEvent, event);
             }
-            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget.get(), event, clipboard);
             if (!accept)
-                accept = findDropZone(newTarget, clipboard);
+                accept = findDropZone(newTarget.get(), clipboard);
             m_shouldOnlyFireDragOverEvent = false;
         }
     }
Domain: Web Framework / Uncategorized;