Commit 8d13417e authored by weinig@apple.com's avatar weinig@apple.com

WebCore: Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276

REGRESSION(r48334): WebKit crashes on file select by drag

Reviewed by Adele Peterson.

Don't use Document.elementFromPoint since it returns null if the point
is outside the viewport.  Instead, just hit test ourselves.

Test: fast/events/drag-file-crash.html

* page/DragController.cpp:
(WebCore::elementUnderMouse):
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::concludeEditDrag):

LayoutTests: Test for https://bugs.webkit.org/show_bug.cgi?id=29276
REGRESSION(r48334): WebKit crashes on file select by drag

Reviewed by Adele Peterson.

* fast/events/drag-file-crash-expected.txt: Added.
* fast/events/drag-file-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent f93e081e
2009-09-18 Sam Weinig <sam@webkit.org>
Reviewed by Adele Peterson.
Test for https://bugs.webkit.org/show_bug.cgi?id=29276
REGRESSION(r48334): WebKit crashes on file select by drag
* fast/events/drag-file-crash-expected.txt: Added.
* fast/events/drag-file-crash.html: Added.
2009-09-18 Steve Block <steveblock@google.com>
Reviewed by Dimitri Glazkov.
......
This is a test for https://bugs.webkit.org/show_bug.cgi?id=29276. It passes if it does not crash. If not run from DRT, drag a file onto the file input.
<style>
#scroller {
height: 1000px;
}
</style>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
function moveMouseToCenterOfElement(element)
{
var centerX = element.offsetLeft + element.offsetWidth / 2;
var centerY = element.offsetTop + element.offsetHeight / 2;
eventSender.mouseMoveTo(centerX, centerY);
}
function run()
{
window.scrollBy(0, 1000);
if (window.eventSender) {
eventSender.beginDragWithFiles(["resources/abe.png"]);
var fileInput = document.getElementById('file');
moveMouseToCenterOfElement(fileInput);
eventSender.mouseUp();
}
}
</script>
<body onload="run()">
<div id="scroller"></div>
<input type="file" id="file">
This is a test for https://bugs.webkit.org/show_bug.cgi?id=29276. It passes if it does not crash. If not run from DRT, drag a file onto the file input.
</body>
2009-09-18 Sam Weinig <sam@webkit.org>
Reviewed by Adele Peterson.
Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
REGRESSION(r48334): WebKit crashes on file select by drag
Don't use Document.elementFromPoint since it returns null if the point
is outside the viewport. Instead, just hit test ourselves.
Test: fast/events/drag-file-crash.html
* page/DragController.cpp:
(WebCore::elementUnderMouse):
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::concludeEditDrag):
2009-09-18 Darin Adler <darin@apple.com>
Reviewed by Sam Weinig.
......@@ -47,6 +47,7 @@
#include "HTMLAnchorElement.h"
#include "HTMLInputElement.h"
#include "HTMLNames.h"
#include "HitTestRequest.h"
#include "HitTestResult.h"
#include "Image.h"
#include "MoveSelectionCommand.h"
......@@ -54,6 +55,7 @@
#include "Page.h"
#include "RenderFileUploadControl.h"
#include "RenderImage.h"
#include "RenderView.h"
#include "ReplaceSelectionCommand.h"
#include "ResourceRequest.h"
#include "SelectionController.h"
......@@ -254,6 +256,25 @@ static HTMLInputElement* asFileInput(Node* node)
return 0;
}
static Element* elementUnderMouse(Document* documentUnderMouse, const IntPoint& p)
{
float zoomFactor = documentUnderMouse->frame()->pageZoomFactor();
IntPoint point = roundedIntPoint(FloatPoint(p.x() * zoomFactor, p.y() * zoomFactor));
HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
HitTestResult result(point);
documentUnderMouse->renderView()->layer()->hitTest(request, result);
Node* n = result.innerNode();
while (n && !n->isElementNode())
n = n->parentNode();
if (n)
n = n->shadowAncestorNode();
ASSERT(n);
return static_cast<Element*>(n);
}
bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask, DragOperation& operation)
{
ASSERT(dragData);
......@@ -288,9 +309,8 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
return true;
}
IntPoint point = frameView->convertFromContainingWindow(dragData->clientPosition());
Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
ASSERT(element);
IntPoint point = frameView->windowToContents(dragData->clientPosition());
Element* element = elementUnderMouse(m_documentUnderMouse, point);
if (!asFileInput(element)) {
VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
m_page->dragCaretController()->setSelection(dragCaret);
......@@ -339,9 +359,8 @@ bool DragController::concludeEditDrag(DragData* dragData)
if (!m_documentUnderMouse)
return false;
IntPoint point = m_documentUnderMouse->view()->convertFromContainingWindow(dragData->clientPosition());
Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
ASSERT(element);
IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
Element* element = elementUnderMouse(m_documentUnderMouse, point);
Frame* innerFrame = element->ownerDocument()->frame();
ASSERT(innerFrame);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment