Title: [139346] trunk
- Revision
- 139346
- Author
- le...@chromium.org
- Date
- 2013-01-10 11:33:20 -0800 (Thu, 10 Jan 2013)
Log Message
ScrollingCoordinator touch event hit rects aren't converted to proper coordinates when in nested views
https://bugs.webkit.org/show_bug.cgi?id=106383
Reviewed by James Robinson.
Source/WebCore:
ScrollingCoordinator uses clippedOverflowRectForRepaint(0) to generate the bounds for a renderer's hit
testing rect. The rect this returns is in the coordinates of its document. This change converts the
rect to the outermost view's coordinate system using convertToContainingView.
Tests: platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html
* page/scrolling/ScrollingCoordinator.cpp:
(WebCore::accumulateRendererTouchEventTargetRects):
LayoutTests:
* platform/chromium/fast/events/touch/resources: Added.
* platform/chromium/fast/events/touch/resources/frame-with-touch-handler.html: Added.
* platform/chromium/fast/events/touch/touch-hit-rects-in-iframe-expected.txt: Added.
* platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (139345 => 139346)
--- trunk/LayoutTests/ChangeLog 2013-01-10 19:29:37 UTC (rev 139345)
+++ trunk/LayoutTests/ChangeLog 2013-01-10 19:33:20 UTC (rev 139346)
@@ -1,5 +1,17 @@
2013-01-10 Levi Weintraub <le...@chromium.org>
+ ScrollingCoordinator touch event hit rects aren't converted to proper coordinates when in nested views
+ https://bugs.webkit.org/show_bug.cgi?id=106383
+
+ Reviewed by James Robinson.
+
+ * platform/chromium/fast/events/touch/resources: Added.
+ * platform/chromium/fast/events/touch/resources/frame-with-touch-handler.html: Added.
+ * platform/chromium/fast/events/touch/touch-hit-rects-in-iframe-expected.txt: Added.
+ * platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html: Added.
+
+2013-01-10 Levi Weintraub <le...@chromium.org>
+
Regression(r137939): Heap-use-after-free in WebCore::accumulateDocumentEventTargetRects
https://bugs.webkit.org/show_bug.cgi?id=106454
Added: trunk/LayoutTests/platform/chromium/fast/events/touch/resources/frame-with-touch-handler.html (0 => 139346)
--- trunk/LayoutTests/platform/chromium/fast/events/touch/resources/frame-with-touch-handler.html (rev 0)
+++ trunk/LayoutTests/platform/chromium/fast/events/touch/resources/frame-with-touch-handler.html 2013-01-10 19:33:20 UTC (rev 139346)
@@ -0,0 +1,8 @@
+<!doctype html>
+<html>
+<body>
+<div id="touchTarget" style="width: 50px; height: 50px; background-color: blue;" _ontouchstart_="function() { };"></div>
+<script>
+document.getElementById("touchTarget").addEventListener("touchstart", function() { }, false);
+</script>
+</body>
\ No newline at end of file
Added: trunk/LayoutTests/platform/chromium/fast/events/touch/touch-hit-rects-in-iframe-expected.txt (0 => 139346)
--- trunk/LayoutTests/platform/chromium/fast/events/touch/touch-hit-rects-in-iframe-expected.txt (rev 0)
+++ trunk/LayoutTests/platform/chromium/fast/events/touch/touch-hit-rects-in-iframe-expected.txt 2013-01-10 19:33:20 UTC (rev 139346)
@@ -0,0 +1,4 @@
+This test validates that touch hit tests rects are created in the coordinates of the outermost view, not their containing view. This test only works in DumpRenderTree.
+[0]: (60, 110, 50, 50)
+[1]: (420, 170, 50, 50)
+
Added: trunk/LayoutTests/platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html (0 => 139346)
--- trunk/LayoutTests/platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html (rev 0)
+++ trunk/LayoutTests/platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html 2013-01-10 19:33:20 UTC (rev 139346)
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+#iframe1 {
+ position: absolute;
+ top: 100px;
+ left: 50px;
+ width: 200px;
+ height: 200px;
+}
+#iframe2 {
+ position: absolute;
+ top: 100px;
+ left: 400px;
+ width: 200px;
+ height: 200px;
+}
+</style>
+<body _onload_="runTest();">
+<div>This test validates that touch hit tests rects are created in the coordinates of the outermost view, not their containing view.
+This test only works in DumpRenderTree.</div>
+<div id="console"></div>
+<iframe id="iframe1" src=""
+<iframe id="iframe2"></iframe>
+<script>
+
+var iframeDocument = document.getElementById("iframe2").contentWindow.document;
+iframeDocument.open('text/html', 'replace');
+iframeDocument.write("<!DOCTYPE html>\n<html><body><iframe src="" style=\"position: relative; top: 50px;\"></iframe></body>");
+iframeDocument.close();
+
+function log(msg) {
+ var span = document.createElement("span");
+ document.getElementById("console").appendChild(span);
+ span.innerHTML = msg + '<br />';
+}
+
+function sortRects(a, b) {
+ return a.top - b.top;
+}
+
+function runTest() {
+ if (!window.testRunner)
+ return;
+ window.testRunner.dumpAsText();
+
+ rects = window.internals.touchEventTargetClientRects(document);
+ var sortedRects = new Array();
+ for (var i = 0; i < rects.length; ++i)
+ sortedRects[i] = rects[i];
+ sortedRects.sort(sortRects);
+ for (var i = 0; i < rects.length; ++i)
+ log("[" + i + "]: (" + sortedRects[i].left + ", " + sortedRects[i].top + ", " + sortedRects[i].width + ", " + sortedRects[i].height + ")");
+}
+</script>
+</body>
Modified: trunk/Source/WebCore/ChangeLog (139345 => 139346)
--- trunk/Source/WebCore/ChangeLog 2013-01-10 19:29:37 UTC (rev 139345)
+++ trunk/Source/WebCore/ChangeLog 2013-01-10 19:33:20 UTC (rev 139346)
@@ -1,5 +1,21 @@
2013-01-10 Levi Weintraub <le...@chromium.org>
+ ScrollingCoordinator touch event hit rects aren't converted to proper coordinates when in nested views
+ https://bugs.webkit.org/show_bug.cgi?id=106383
+
+ Reviewed by James Robinson.
+
+ ScrollingCoordinator uses clippedOverflowRectForRepaint(0) to generate the bounds for a renderer's hit
+ testing rect. The rect this returns is in the coordinates of its document. This change converts the
+ rect to the outermost view's coordinate system using convertToContainingView.
+
+ Tests: platform/chromium/fast/events/touch/touch-hit-rects-in-iframe.html
+
+ * page/scrolling/ScrollingCoordinator.cpp:
+ (WebCore::accumulateRendererTouchEventTargetRects):
+
+2013-01-10 Levi Weintraub <le...@chromium.org>
+
Regression(r137939): Heap-use-after-free in WebCore::accumulateDocumentEventTargetRects
https://bugs.webkit.org/show_bug.cgi?id=106454
Modified: trunk/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp (139345 => 139346)
--- trunk/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp 2013-01-10 19:29:37 UTC (rev 139345)
+++ trunk/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp 2013-01-10 19:33:20 UTC (rev 139346)
@@ -185,9 +185,16 @@
if (parentRect.isEmpty() || renderer->isFloating() || renderer->isPositioned() || renderer->hasTransform()) {
// FIXME: This method is O(N^2) as it walks the tree to the root for every renderer. RenderGeometryMap would fix this.
IntRect r = enclosingIntRect(renderer->clippedOverflowRectForRepaint(0));
- if (!r.isEmpty() && !parentRect.contains(r)) {
- rects.append(r);
- adjustedParentRect = r;
+ if (!r.isEmpty()) {
+ // Convert to the top-level view's coordinates.
+ ASSERT(renderer->document()->view());
+ for (ScrollView* view = renderer->document()->view(); view && view->parent(); view = view->parent())
+ r = view->convertToContainingView(r);
+
+ if (!parentRect.contains(r)) {
+ rects.append(r);
+ adjustedParentRect = r;
+ }
}
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
