-
https://webkit.org/b/119930rniwa@webkit.org authored
<https://webkit.org/b/119930> input[type=range]: Fix a crash by changing input type in 'input' event handler Reviewed by Kent Tamura. Source/WebCore: Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5 In SliderThumbElement::setPositionFromPoint, renderer() can be NULL after HTMLInputElement::setValueFromRenderer, which dispatches 'input' event. Also, make a local vairable 'input' a RefPtr just in case. Also add null-poinetr checks for the host element as SliderThumbElement only weakly holds onto the host element. Test: fast/forms/range/range-type-change-oninput.html * html/shadow/SliderThumbElement.cpp: (WebCore::SliderThumbElement::isDisabledFormControl): (WebCore::SliderThumbElement::matchesReadOnlyPseudoClass): (WebCore::SliderThumbElement::matchesReadWritePseudoClass): (WebCore::SliderThumbElement::setPositionFromPoint): (WebCore::SliderThumbElement::hostInput): LayoutTests: Add a regresion test from https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5 * fast/forms/range/range-type-change-oninput-expected.txt: Added. * fast/forms/range/range-type-change-oninput.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154308 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fe7996e7