[M118] Fix crash in DateTimeFieldElement::DefaultKeyboardEventHandler

In DateTimeFieldElement::DefaultKeyboardEventHandler, we will get a crash if GetComputedStyle() is called, but returns null. This could happen for an element where the style does not need to be displayed. To fix that, we should use the function EnsureComputedStyle() instead. (cherry picked from commit b227311) Change-Id: Icb1700f904fcbc0f4cbea78fbdb824b42f7d8149 Bug: 1489714 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4917073 Reviewed-by: David Baron <dbaron@chromium.org> Commit-Queue: Di Zhang <dizhangg@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1206408} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4923273 Reviewed-by: Daniel Yip <danielyip@google.com> Owners-Override: Daniel Yip <danielyip@google.com> Cr-Commit-Position: refs/branch-heads/5993@{#1216} Cr-Branched-From: 5113507-refs/heads/main@{#1192594}
chromium · Oct 9, 2023 · e52f33f · e52f33f
1 parent d915a85
commit e52f33f
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 1 deletion.
diff --git a/third_party/blink/renderer/core/html/forms/date_time_field_element.cc b/third_party/blink/renderer/core/html/forms/date_time_field_element.cc
@@ -82,7 +82,8 @@ void DateTimeFieldElement::DefaultKeyboardEventHandler(
     return;
 
   const String& key = keyboard_event.key();
-  bool is_horizontal = GetComputedStyle()->IsHorizontalWritingMode();
+  bool is_horizontal =
+      GetComputedStyle() ? GetComputedStyle()->IsHorizontalWritingMode() : true;
 
   if ((is_horizontal && key == "ArrowLeft") ||
       (!is_horizontal && key == "ArrowUp")) {

diff --git a/third_party/blink/web_tests/fast/forms/date/date-keyboardoperation-no-crash-expected.txt b/third_party/blink/web_tests/fast/forms/date/date-keyboardoperation-no-crash-expected.txt
@@ -0,0 +1 @@
+PASS
diff --git a/third_party/blink/web_tests/fast/forms/date/date-keyboardoperation-no-crash.html b/third_party/blink/web_tests/fast/forms/date/date-keyboardoperation-no-crash.html
@@ -0,0 +1,28 @@
+
+<!DOCTYPE html>
+<html>
+<script src="../../resources/js-test.js"></script>
+<script>
+// We had a reading near-null address crash in DateTimeFieldElement::DefaultKeyboardEventHandler.
+function runTest() {
+  if (!window.testRunner)
+    return;
+  if (!window.eventSender)
+    return;
+  testRunner.dumpAsText();
+
+  const input = document.createElement('input');
+  document.body.appendChild(input);
+  input.type = "date";
+  input.style.writingMode = "horizontal-tb";
+  input.value = "2023-07-22";
+
+  input.focus();
+  input.style.display = 'none';
+  eventSender.keyDown('ArrowDown');
+  document.body.removeChild(input);
+}
+
+</script>
+<body onload="runTest();">PASS</body>
+</html>