Commit a7365617 authored by sullivan@apple.com's avatar sullivan@apple.com

WebCore:

2008-05-13  John Sullivan  <sullivan@apple.com>

        Reviewed by Dan Bernstein and Kevin Decker
        
        - fixed <rdar://problem/5879597> reproducible crash in HTMLSelectElement::typeAheadFind

        Test: fast/forms/select-type-ahead-list-box-no-selection.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::typeAheadFind):
        When there's no initially-selected element, we were accessing index -1. Check for this
        case and start at 0.

LayoutTests:

2008-05-13  John Sullivan  <sullivan@apple.com>

        Reviewed by Justin Garcia and Tim Hatcher
        
        <rdar://problem/5879597> reproducible crash in HTMLSelectElement::typeAheadFind

        * fast/forms/select-type-ahead-list-box-no-selection-expected.txt: Added.
        * fast/forms/select-type-ahead-list-box-no-selection.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@33392 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent e7fdd2ce
2008-05-13 John Sullivan <sullivan@apple.com>
Reviewed by Justin Garcia and Tim Hatcher
<rdar://problem/5879597> reproducible crash in HTMLSelectElement::typeAheadFind
* fast/forms/select-type-ahead-list-box-no-selection-expected.txt: Added.
* fast/forms/select-type-ahead-list-box-no-selection.html: Added.
2008-05-13 Alexey Proskuryakov <ap@webkit.org> 2008-05-13 Alexey Proskuryakov <ap@webkit.org>
Reviewed by John Sullivan. Reviewed by John Sullivan.
Test for rdar://problem/5879597 Type-to-select in lists with no initial selection can crash.
SUCCESS
<p>
Test for <i><a href="rdar://problem/5879597">rdar://problem/5879597</a>
Type-to-select in lists with no initial selection can crash</i>.
</p>
<select size="3" id="list">
<option>One</option>
<option>Two</option>
<option>Three</option>
<option>Four</option>
<option>Five</option>
</select>
<div id="result">To run interactively, tab to list and type "12" quickly. If it doesn't crash, the test passed.</div>
<script>
if (window.layoutTestController) {
layoutTestController.dumpAsText();
var menu = document.getElementById("list");
menu.focus();
eventSender.keyDown("1");
eventSender.keyDown("2");
var result = document.getElementById("result");
result.innerText = "SUCCESS";
}
</script>
2008-05-13 John Sullivan <sullivan@apple.com>
Reviewed by Dan Bernstein and Kevin Decker
- fixed <rdar://problem/5879597> reproducible crash in HTMLSelectElement::typeAheadFind
Test: fast/forms/select-type-ahead-list-box-no-selection.html
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::typeAheadFind):
When there's no initially-selected element, we were accessing index -1. Check for this
case and start at 0.
2008-05-13 Sam Weinig <sam@webkit.org> 2008-05-13 Sam Weinig <sam@webkit.org>
Reviewed by Dan Bernstein. Reviewed by Dan Bernstein.
...@@ -978,7 +978,9 @@ void HTMLSelectElement::typeAheadFind(KeyboardEvent* event) ...@@ -978,7 +978,9 @@ void HTMLSelectElement::typeAheadFind(KeyboardEvent* event)
if (itemCount < 1) if (itemCount < 1)
return; return;
int index = (optionToListIndex(selectedIndex()) + searchStartOffset) % itemCount; int selected = selectedIndex();
int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
ASSERT(index >= 0);
for (int i = 0; i < itemCount; i++, index = (index + 1) % itemCount) { for (int i = 0; i < itemCount; i++, index = (index + 1) % itemCount) {
if (!items[index]->hasTagName(optionTag) || items[index]->disabled()) if (!items[index]->hasTagName(optionTag) || items[index]->disabled())
continue; continue;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment