[Webkit-unassigned] [Bug 42047] Add click handler to the input element's speech button.

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Jul 14 02:03:05 PDT 2010


https://bugs.webkit.org/show_bug.cgi?id=42047


Kent Tamura <tkent at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #61486|review?                     |review-
               Flag|                            |




--- Comment #2 from Kent Tamura <tkent at chromium.org>  2010-07-14 02:03:05 PST ---
(From update of attachment 61486)
WebCore/rendering/TextControlInnerElements.cpp:353
 +          input->focus();
focus() dispatches a focus event, and an event handler might remove 'input' node.  So the next input->select() can use a deleted object.
Please look at SpinButtonElement::defaultEventHandler() of the latest revision of TextControlInnerElements.cpp.


WebCore/rendering/TextControlInnerElements.cpp:392
 +      input->dispatchFormControlChangeEvent();
This has a similar problem.  An event handler of the event might remove the 'input' node.  So this InputFieldSpeechButtonElement instance might be removed.
So, we need
  RefPtr<InputFieldSpeechButtonElement> protector(this);
before input->dispatchFormControlChangeEvent().

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list