[webkit-changes] cvs commit: WebCore/layout-tests/fast/events access-key-self-destruct-expected.txt access-key-self-destruct.html

[Darin]

darin       05/09/11 21:42:30

  Modified:    .        ChangeLog
               khtml/xml dom_nodeimpl.cpp
  Added:       layout-tests/fast/events
                        access-key-self-destruct-expected.txt
                        access-key-self-destruct.html
  Log:
          Reviewed by John Sullivan.
  
          - fixed <rdar://problem/4126166> using JavaScript-assigned accesskeys crashes Safari - DOM::NodeImpl::dispatchEvent
  
          Test cases added:
          * layout-tests/fast/events/access-key-self-destruct.html: Added.
          * layout-tests/fast/events/access-key-self-destruct-expected.txt: Added.
  
          * khtml/xml/dom_nodeimpl.cpp: (DOM::NodeImpl::dispatchMouseEvent): Ref the node for the duration
          with a SharedPtr; this helps in cases where the last reference to the node goes away inside the
          event handler.
  
  Revision  Changes    Path
  1.116     +14 -0     WebCore/ChangeLog
  
  Index: ChangeLog
  ===================================================================
  RCS file: /cvs/root/WebCore/ChangeLog,v
  retrieving revision 1.115
  retrieving revision 1.116
  diff -u -r1.115 -r1.116
  --- ChangeLog	12 Sep 2005 03:40:36 -0000	1.115
  +++ ChangeLog	12 Sep 2005 04:42:29 -0000	1.116
  @@ -1,5 +1,19 @@
   2005-09-11  Darin Adler  <darin at apple.com>
   
  +        Reviewed by John Sullivan.
  +
  +        - fixed <rdar://problem/4126166> using JavaScript-assigned accesskeys crashes Safari - DOM::NodeImpl::dispatchEvent
  +
  +        Test cases added:
  +        * layout-tests/fast/events/access-key-self-destruct.html: Added.
  +        * layout-tests/fast/events/access-key-self-destruct-expected.txt: Added.
  +
  +        * khtml/xml/dom_nodeimpl.cpp: (DOM::NodeImpl::dispatchMouseEvent): Ref the node for the duration
  +        with a SharedPtr; this helps in cases where the last reference to the node goes away inside the
  +        event handler.
  +
  +2005-09-11  Darin Adler  <darin at apple.com>
  +
           Reviewed by Eric.
   
           - changed back the name of a couple of string() functions that were renamed to qstring() by accident
  
  
  
  1.187     +5 -0      WebCore/khtml/xml/dom_nodeimpl.cpp
  
  Index: dom_nodeimpl.cpp
  ===================================================================
  RCS file: /cvs/root/WebCore/khtml/xml/dom_nodeimpl.cpp,v
  retrieving revision 1.186
  retrieving revision 1.187
  diff -u -r1.186 -r1.187
  --- dom_nodeimpl.cpp	7 Sep 2005 18:10:37 -0000	1.186
  +++ dom_nodeimpl.cpp	12 Sep 2005 04:42:29 -0000	1.187
  @@ -763,6 +763,11 @@
       if (eventType.isEmpty())
           return false; // Shouldn't happen.
   
  +    // Dispatching the first event can easily result in this node being destroyed.
  +    // Since we dispatch up to three events here, we need to make sure we're referenced
  +    // so the pointer will be good for the two subsequent ones.
  +    SharedPtr<NodeImpl> protect(this);
  +
       bool cancelable = eventType != mousemoveEvent;
       
       int exceptioncode = 0;
  
  
  
  1.1                  WebCore/layout-tests/fast/events/access-key-self-destruct-expected.txt
  
  Index: access-key-self-destruct-expected.txt
  ===================================================================
  This tests what happens when you use accesskey to trigger a script that causes a node to get destroyed without ever having a reference to it from JavaScript. With older versions of WebKit this used to cause a crash.
  
  If you can see this text and there was no crash, the test was a success.
  
  
  
  
  
  1.1                  WebCore/layout-tests/fast/events/access-key-self-destruct.html
  
  Index: access-key-self-destruct.html
  ===================================================================
  <script>
  function replace()
  {
      document.getElementById("target").innerHTML = "If you can see this text and there was no crash, the test was a success.";
  }
  function test()
  {
      if (window.layoutTestController)
          layoutTestController.dumpAsText();
      
      var event = document.createEvent("KeyboardEvent");
      event.initKeyboardEvent("keydown", true, true, document.defaultView, "a", 0, true, false, false, false, false);
      document.dispatchEvent(event);
  }
  </script>
  <body onload="test()">
  <p>This tests what happens when you use accesskey to trigger a script that causes a node to get destroyed
  without ever having a reference to it from JavaScript. With older versions of WebKit this used to cause a crash.</p>
  <p id="target"><a href="javascript:replace()" accesskey="a"></a>If you can see this text, the test was a failure.</p>
  </body>