Merge r167167 - Assertion failure changing select element size during…

… focus event dispatch <https://bugs.webkit.org/show_bug.cgi?id=131566> <rdar://problem/16400735> Reviewed by Andy Estes. Source/WebCore: Test: fast/forms/select-change-size-during-focus.html * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Adopt the fix from Chromium r171216; check that the renderer is still of the expected type, and return early if it is not. LayoutTests: * fast/forms/select-change-size-during-focus-expected.txt: Added. * fast/forms/select-change-size-during-focus.html: Added.
WebKit · May 5, 2014 · 4044f4f · 4044f4f
1 parent ec8a474
commit 4044f4f
Show file tree

Hide file tree

Showing 5 changed files with 69 additions and 2 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2014-04-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Assertion failure changing select element size during focus event
+        dispatch
+        <https://bugs.webkit.org/show_bug.cgi?id=131566>
+        <rdar://problem/16400735>
+
+        Reviewed by Andy Estes.
+
+        * fast/forms/select-change-size-during-focus-expected.txt: Added.
+        * fast/forms/select-change-size-during-focus.html: Added.
+
 2014-04-10  Jon Honeycutt  <jhoneycutt@apple.com>
 
         Assertion failure in WebCore::FlexBoxIterator::next()

diff --git a/LayoutTests/fast/forms/select-change-size-during-focus-expected.txt b/LayoutTests/fast/forms/select-change-size-during-focus-expected.txt
@@ -0,0 +1,3 @@
+WebKit bug #131566: Assertion failure changing select element size during focus event dispatch. This test passes if it does not assert in a debug build.
+
+
diff --git a/LayoutTests/fast/forms/select-change-size-during-focus.html b/LayoutTests/fast/forms/select-change-size-during-focus.html
@@ -0,0 +1,36 @@
+<html>
+    <head>
+        <script>
+            function setup() {
+                if (window.testRunner) {
+                    window.testRunner.dumpAsText();
+                    window.testRunner.waitUntilDone();
+                }
+
+                s = document.getElementById("select");
+
+                s.addEventListener("focus", function() {
+                    s.size = 1;
+
+                    window.setTimeout(function() {
+                        if (window.testRunner)
+                            window.testRunner.notifyDone();
+                    }, 0);
+                });
+
+                ev = document.createEvent("MouseEvent");
+                ev.initMouseEvent("mousedown", true, true, window, 0, 0, 0, 20, 20, false, false, false, false, 0, null);
+                s.dispatchEvent(ev);
+            }
+        </script>
+    </head>
+    <body onload="setup()">
+        <p>
+            WebKit bug #<a href="https://bugs.webkit.org/show_bug.cgi?id=131566">131566</a>: Assertion failure changing select element size during focus event dispatch. This test passes if it does not assert in a debug build.
+        </p>
+        <select id="select" size="2">
+            <option>option 1</option>
+            <option>option 2</option>
+        </select>
+    </body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2014-04-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Assertion failure changing select element size during focus event
+        dispatch
+        <https://bugs.webkit.org/show_bug.cgi?id=131566>
+        <rdar://problem/16400735>
+
+        Reviewed by Andy Estes.
+
+        Test: fast/forms/select-change-size-during-focus.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        Adopt the fix from Chromium r171216; check that the renderer is still
+        of the expected type, and return early if it is not.
+
 2014-04-08  Jon Honeycutt  <jhoneycutt@apple.com>
 
         Assertion failure in WebCore::FlexBoxIterator::next()

diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -1343,8 +1343,8 @@ void HTMLSelectElement::listBoxDefaultEventHandler(Event* event)
 
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         focus();
-        // Calling focus() may cause us to lose our renderer, in which case do not want to handle the event.
-        if (!renderer())
+        // Calling focus() may remove or change our renderer, in which case we don't want to handle the event further.
+        if (!renderer() || !renderer()->isListBox())
             return;
 
         // Convert to coords relative to the list box if needed.