[Webkit-unassigned] [Bug 119930] New: input[type=range]: Fix a crash by changing input type in 'input' event handler

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=119930

           Summary: input[type=range]: Fix a crash by changing input type
                    in 'input' event handler
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: BlinkMergeCandidate, InChromiumBugs
          Severity: Normal
          Priority: P2
         Component: Forms
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rniwa at webkit.org
                CC: darin at apple.com, ap at webkit.org, tkent at chromium.org,
                    webkit-bug-importer at group.apple.com


Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5

In SliderThumbElement::setPositionFromPoint, renderer() can be NULL
after HTMLInputElement::setValueFromRenderer, which dispatches 'input'
event. Also, make a local vairable 'input' a RefPtr just in case.

http://crbug.com/248402

I reproduced the crash in ToT WebKit.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.