Skip to content

GitLab

W
webkit
Commit 8d13417e authored by weinig@apple.com's avatar weinig@apple.com
Browse files
Options

WebCore: Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276 

REGRESSION(r48334): WebKit crashes on file select by drag

Reviewed by Adele Peterson.

Don't use Document.elementFromPoint since it returns null if the point
is outside the viewport.  Instead, just hit test ourselves.

Test: fast/events/drag-file-crash.html

* page/DragController.cpp:
(WebCore::elementUnderMouse):
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::concludeEditDrag):

LayoutTests: Test for https://bugs.webkit.org/show_bug.cgi?id=29276
REGRESSION(r48334): WebKit crashes on file select by drag

Reviewed by Adele Peterson.

* fast/events/drag-file-crash-expected.txt: Added.
* fast/events/drag-file-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent f93e081e
Hide whitespace changes
Inline Side-by-side
Showing with 85 additions and 6 deletions
LayoutTests/ChangeLog
View file @ 8d13417e
2009-09-18 Sam Weinig <sam@webkit.org>
Reviewed by Adele Peterson.
Test for https://bugs.webkit.org/show_bug.cgi?id=29276
REGRESSION(r48334): WebKit crashes on file select by drag
* fast/events/drag-file-crash-expected.txt: Added.
* fast/events/drag-file-crash.html: Added.
2009-09-18 Steve Block <steveblock@google.com>
Reviewed by Dimitri Glazkov.
......
LayoutTests/fast/events/drag-file-crash-expected.txt 0 → 100644
View file @ 8d13417e
This is a test for https://bugs.webkit.org/show_bug.cgi?id=29276. It passes if it does not crash. If not run from DRT, drag a file onto the file input.
LayoutTests/fast/events/drag-file-crash.html 0 → 100644
View file @ 8d13417e
<style>
#scroller {
height: 1000px;
}
</style>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
function moveMouseToCenterOfElement(element)
{
var centerX = element.offsetLeft + element.offsetWidth / 2;
var centerY = element.offsetTop + element.offsetHeight / 2;
eventSender.mouseMoveTo(centerX, centerY);
}
function run()
{
window.scrollBy(0, 1000);
if (window.eventSender) {
eventSender.beginDragWithFiles(["resources/abe.png"]);
var fileInput = document.getElementById('file');
moveMouseToCenterOfElement(fileInput);
eventSender.mouseUp();
}
}
</script>
<body onload="run()">
<div id="scroller"></div>
<input type="file" id="file">
This is a test for https://bugs.webkit.org/show_bug.cgi?id=29276. It passes if it does not crash. If not run from DRT, drag a file onto the file input.
</body>
WebCore/ChangeLog
View file @ 8d13417e
2009-09-18 Sam Weinig <sam@webkit.org>
Reviewed by Adele Peterson.
Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
REGRESSION(r48334): WebKit crashes on file select by drag
Don't use Document.elementFromPoint since it returns null if the point
is outside the viewport. Instead, just hit test ourselves.
Test: fast/events/drag-file-crash.html
* page/DragController.cpp:
(WebCore::elementUnderMouse):
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::concludeEditDrag):
2009-09-18 Darin Adler <darin@apple.com>
Reviewed by Sam Weinig.
WebCore/page/DragController.cpp
View file @ 8d13417e
......@@ -47,6 +47,7 @@
#include "HTMLAnchorElement.h"
#include "HTMLInputElement.h"
#include "HTMLNames.h"
#include "HitTestRequest.h"
#include "HitTestResult.h"
#include "Image.h"
#include "MoveSelectionCommand.h"
......@@ -54,6 +55,7 @@
#include "Page.h"
#include "RenderFileUploadControl.h"
#include "RenderImage.h"
#include "RenderView.h"
#include "ReplaceSelectionCommand.h"
#include "ResourceRequest.h"
#include "SelectionController.h"
......@@ -254,6 +256,25 @@ static HTMLInputElement* asFileInput(Node* node)
return 0;
}
static Element* elementUnderMouse(Document* documentUnderMouse, const IntPoint& p)
{
float zoomFactor = documentUnderMouse->frame()->pageZoomFactor();
IntPoint point = roundedIntPoint(FloatPoint(p.x() * zoomFactor, p.y() * zoomFactor));
HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
HitTestResult result(point);
documentUnderMouse->renderView()->layer()->hitTest(request, result);
Node* n = result.innerNode();
while (n && !n->isElementNode())
n = n->parentNode();
if (n)
n = n->shadowAncestorNode();
ASSERT(n);
return static_cast<Element*>(n);
}
bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask, DragOperation& operation)
{
ASSERT(dragData);
......@@ -288,9 +309,8 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
return true;
}
IntPoint point = frameView->convertFromContainingWindow(dragData->clientPosition());
Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
ASSERT(element);
IntPoint point = frameView->windowToContents(dragData->clientPosition());
Element* element = elementUnderMouse(m_documentUnderMouse, point);
if (!asFileInput(element)) {
VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
m_page->dragCaretController()->setSelection(dragCaret);
......@@ -339,9 +359,8 @@ bool DragController::concludeEditDrag(DragData* dragData)
if (!m_documentUnderMouse)
return false;
IntPoint point = m_documentUnderMouse->view()->convertFromContainingWindow(dragData->clientPosition());
Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
ASSERT(element);
IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
Element* element = elementUnderMouse(m_documentUnderMouse, point);
Frame* innerFrame = element->ownerDocument()->frame();
ASSERT(innerFrame);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment