Title: [134459] branches/chromium/1312
- Revision
- 134459
- Author
- kar...@chromium.org
- Date
- 2012-11-13 11:55:34 -0800 (Tue, 13 Nov 2012)
Log Message
Merge 134377 - Crash when replacing parts of text inputs with content: url(...)
https://bugs.webkit.org/show_bug.cgi?id=101133
Reviewed by Kent Tamura.
Source/WebCore:
Disable directly setting content of elements in an input element's
shadow dom tree, because the setting breaks input element's behavior.
Tests: fast/forms/number/number-content-url-crash.html
fast/forms/search/search-content-url-crash.html
* css/html.css:
(input::-webkit-textfield-decoration-container):
Use important to disable overriding an input element's content
property.
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::attach):
Added ASSERTION. No content should be applied to
input::-webkit-textfield-decoration-container.
LayoutTests:
* fast/forms/number/number-content-url-crash-expected.txt: Added.
* fast/forms/number/number-content-url-crash.html: Added.
* fast/forms/search/search-content-url-crash-expected.txt: Added.
* fast/forms/search/search-content-url-crash.html: Added.
TBR=ta...@google.com
Review URL: https://codereview.chromium.org/11293258
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1312/LayoutTests/fast/forms/number/number-content-url-crash-expected.txt (from rev 134377, trunk/LayoutTests/fast/forms/number/number-content-url-crash-expected.txt) (0 => 134459)
--- branches/chromium/1312/LayoutTests/fast/forms/number/number-content-url-crash-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/forms/number/number-content-url-crash-expected.txt 2012-11-13 19:55:34 UTC (rev 134459)
@@ -0,0 +1 @@
+ PASS
Copied: branches/chromium/1312/LayoutTests/fast/forms/number/number-content-url-crash.html (from rev 134377, trunk/LayoutTests/fast/forms/number/number-content-url-crash.html) (0 => 134459)
--- branches/chromium/1312/LayoutTests/fast/forms/number/number-content-url-crash.html (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/forms/number/number-content-url-crash.html 2012-11-13 19:55:34 UTC (rev 134459)
@@ -0,0 +1,19 @@
+<!doctype html>
+<head>
+<style>
+input::-webkit-textfield-decoration-container {
+ content: url("") !important;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<!-- [bug 101133] https://bugs.webkit.org/show_bug.cgi?id=101133 -->
+<!-- Crash when replacing parts of text inputs with content: url(...) -->
+<!-- If this test passes, we can see juast "PASS". -->
+<input type="number">
+PASS
+</body>
Copied: branches/chromium/1312/LayoutTests/fast/forms/search/search-content-url-crash-expected.txt (from rev 134377, trunk/LayoutTests/fast/forms/search/search-content-url-crash-expected.txt) (0 => 134459)
--- branches/chromium/1312/LayoutTests/fast/forms/search/search-content-url-crash-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/forms/search/search-content-url-crash-expected.txt 2012-11-13 19:55:34 UTC (rev 134459)
@@ -0,0 +1 @@
+ PASS
Copied: branches/chromium/1312/LayoutTests/fast/forms/search/search-content-url-crash.html (from rev 134377, trunk/LayoutTests/fast/forms/search/search-content-url-crash.html) (0 => 134459)
--- branches/chromium/1312/LayoutTests/fast/forms/search/search-content-url-crash.html (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/forms/search/search-content-url-crash.html 2012-11-13 19:55:34 UTC (rev 134459)
@@ -0,0 +1,19 @@
+<!doctype html>
+<head>
+<style>
+input::-webkit-textfield-decoration-container {
+ content: url("") !important;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<!-- [bug 101133] https://bugs.webkit.org/show_bug.cgi?id=101133 -->
+<!-- Crash when replacing parts of text inputs with content: url(...) -->
+<!-- If this test passes, we can see juast "PASS". -->
+<input type="search">
+PASS
+</body>
Modified: branches/chromium/1312/Source/WebCore/css/html.css (134458 => 134459)
--- branches/chromium/1312/Source/WebCore/css/html.css 2012-11-13 19:53:22 UTC (rev 134458)
+++ branches/chromium/1312/Source/WebCore/css/html.css 2012-11-13 19:55:34 UTC (rev 134459)
@@ -436,6 +436,7 @@
display: -webkit-box;
-webkit-box-align: center;
-webkit-user-modify: read-only !important;
+ content: none !important;
}
input[type="search"]::-webkit-textfield-decoration-container {
Modified: branches/chromium/1312/Source/WebCore/html/TextFieldInputType.cpp (134458 => 134459)
--- branches/chromium/1312/Source/WebCore/html/TextFieldInputType.cpp 2012-11-13 19:53:22 UTC (rev 134458)
+++ branches/chromium/1312/Source/WebCore/html/TextFieldInputType.cpp 2012-11-13 19:55:34 UTC (rev 134459)
@@ -425,6 +425,9 @@
void TextFieldInputType::attach()
{
InputType::attach();
+ // If container exists, the container should not have any content data.
+ ASSERT(!m_container || !m_container->renderStyle() || !m_container->renderStyle()->hasContent());
+
element()->fixPlaceholderRenderer(m_placeholder.get(), m_container ? m_container.get() : m_innerText.get());
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
