[webkit-reviews] review denied: [Bug 111319] Add clear button to date/time input types : [Attachment 191487] Patch

[bugzilla-daemon at webkit.org]

Kent Tamura (ooo until Mar 15) <tkent at chromium.org> has denied Keishi Hattori
<keishi at webkit.org>'s request for review:
Bug 111319: Add clear button to date/time input types
https://bugs.webkit.org/show_bug.cgi?id=111319

Attachment 191487: Patch
https://bugs.webkit.org/attachment.cgi?id=191487&action=review

------- Additional Comments from Kent Tamura (ooo until Mar 15)
<tkent at chromium.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=191487&action=review


> Source/WebCore/ChangeLog:60
> +	   * html/shadow/ClearButtonElement.cpp: Added.

Adding ClearButtonElement and updating input[type=search] code should be a
separated patch, and I think we can avoid rebaseline for existing type=search
tests.

> Source/WebCore/css/html.css:458
> -input[type="search"]::-webkit-search-cancel-button {
> +input::-webkit-clear-button {
>      -webkit-appearance: searchfield-cancel-button;
>      display: block;
>      -webkit-box-flex: 0;
>      -webkit-user-modify: read-only !important;
> +    margin-left: 2px;

We don't need to add the margin for input[type=search]. So, we should

input::-webkit-clear-button {
  ...
  display: inline-block; /* Multiple fields UI requires inline-block. See Bug
110974	*/
  ....
  margin-left: 2px;
}

input[type="search"]::-webkit-clear-button {
    margin-left: 0;
}

> Source/WebCore/html/SearchInputType.cpp:200
> +    element()->focus();
> +    element()->select();

Possible use-after-free for 'this' by focus events.

> Source/WebCore/html/SearchInputType.cpp:212
> +    element()->setValueForUser("");
> +    updateClearButtonVisibility();
> +    element()->onSearch();

Possible use-after-free for 'this' by 'change' 'input' events.