Title: [139662] branches/chromium/1364
- Revision
- 139662
- Author
- cev...@google.com
- Date
- 2013-01-14 14:14:33 -0800 (Mon, 14 Jan 2013)
Log Message
Merge 139345
BUG=169006
Review URL: https://codereview.chromium.org/11884035
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash-expected.txt (from rev 139345, trunk/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash-expected.txt) (0 => 139662)
--- branches/chromium/1364/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash-expected.txt 2013-01-14 22:14:33 UTC (rev 139662)
@@ -0,0 +1,2 @@
+
+Test passes if DRT doesn't crash.
Copied: branches/chromium/1364/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash.html (from rev 139345, trunk/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash.html) (0 => 139662)
--- branches/chromium/1364/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash.html (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/events/touch/nested-document-with-touch-handler-detached-crash.html 2013-01-14 22:14:33 UTC (rev 139662)
@@ -0,0 +1,15 @@
+<!doctype html>
+<html>
+<body>
+<iframe id="testIframe" srcdoc="<iframe seamless srcdoc=' '> border: 2px solid black"></iframe>
+<div>Test passes if DRT doesn't crash.</div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var testIframe = document.getElementById('testIframe');
+var input = testIframe.contentDocument.createElement('input');
+input.type = "RANGE";
+input = 0;
+</script>
+</body>
Modified: branches/chromium/1364/Source/WebCore/dom/Document.cpp (139661 => 139662)
--- branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-01-14 22:11:30 UTC (rev 139661)
+++ branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-01-14 22:14:33 UTC (rev 139662)
@@ -2138,6 +2138,11 @@
if (render)
render->destroy();
+#if ENABLE(TOUCH_EVENTS)
+ if (m_touchEventTargets && m_touchEventTargets->size() && parentDocument())
+ parentDocument()->didRemoveEventTargetNode(this);
+#endif
+
// This is required, as our Frame might delete itself as soon as it detaches
// us. However, this violates Node::detach() semantics, as it's never
// possible to re-attach. Eventually Document::detach() should be renamed,
@@ -5674,11 +5679,11 @@
#if ENABLE(TOUCH_EVENTS)
void Document::didRemoveEventTargetNode(Node* handler)
{
- if (m_touchEventTargets.get())
+ if (m_touchEventTargets) {
m_touchEventTargets->removeAll(handler);
- if (handler == this)
- if (Document* parentDocument = this->parentDocument())
- parentDocument->didRemoveEventTargetNode(this);
+ if ((handler == this || m_touchEventTargets->isEmpty()) && parentDocument())
+ parentDocument()->didRemoveEventTargetNode(this);
+ }
}
#endif
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
