[Webkit-unassigned] [Bug 42047] Add click handler to the input element's speech button.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Jul 14 02:03:05 PDT 2010
https://bugs.webkit.org/show_bug.cgi?id=42047
Kent Tamura <tkent at chromium.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #61486|review? |review-
Flag| |
--- Comment #2 from Kent Tamura <tkent at chromium.org> 2010-07-14 02:03:05 PST ---
(From update of attachment 61486)
WebCore/rendering/TextControlInnerElements.cpp:353
+ input->focus();
focus() dispatches a focus event, and an event handler might remove 'input' node. So the next input->select() can use a deleted object.
Please look at SpinButtonElement::defaultEventHandler() of the latest revision of TextControlInnerElements.cpp.
WebCore/rendering/TextControlInnerElements.cpp:392
+ input->dispatchFormControlChangeEvent();
This has a similar problem. An event handler of the event might remove the 'input' node. So this InputFieldSpeechButtonElement instance might be removed.
So, we need
RefPtr<InputFieldSpeechButtonElement> protector(this);
before input->dispatchFormControlChangeEvent().
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list