Attachment #351529 for bug #190252

View Details Raw Unified Return to Bug 190252

| Differences between



2018-10-03  Chris Dumez  <cdumez@apple.com>

        Regression(r236779): Crash when changing the input element type from inside an 'input' event listener
        https://bugs.webkit.org/show_bug.cgi?id=190252

        Reviewed by NOBODY (OOPS!).

        Add a null check for element() after firing the 'input' event and before firing the 'change' event
        in case the input event listener changes the input type.

        Tests: fast/dom/HTMLInputElement/change-type-in-click-event-listener.html
               fast/dom/HTMLInputElement/change-type-in-input-event-listener.html

        * html/BaseCheckableInputType.cpp:
        (WebCore::BaseCheckableInputType::fireInputAndChangeEvents):

2018-10-03  Chris Dumez  <cdumez@apple.com>

        input.checked is incorrect while we're parsing its children




    element()->setTextAsOfLastFormControlChangeEvent(String());
    element()->dispatchInputEvent();
    if (auto* element = this->element())
        element->dispatchFormControlChangeEvent();
}

} // namespace WebCore



2018-10-03  Chris Dumez  <cdumez@apple.com>

        Regression(r236779): Crash when changing the input element type from inside an 'input' event listener
        https://bugs.webkit.org/show_bug.cgi?id=190252

        Reviewed by NOBODY (OOPS!).

        Add layout test coverage.

        * fast/dom/HTMLInputElement/change-type-in-click-event-listener-expected.txt: Added.
        * fast/dom/HTMLInputElement/change-type-in-click-event-listener.html: Added.
        * fast/dom/HTMLInputElement/change-type-in-input-event-listener-expected.txt: Added.
        * fast/dom/HTMLInputElement/change-type-in-input-event-listener.html: Added.

2018-10-03  Youenn Fablet  <youenn@apple.com>

        Enable H264 simulcast



Make sure we do not crash if the 'click' event listener changes the input type.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS Click event was fired
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE html>
<html>
<head>
<script src="../../../resources/js-test.js"></script>
</head>
<body>
<script>
description("Make sure we do not crash if the 'click' event listener changes the input type.");

onload = () => {
    testInput.addEventListener("click", () => {
        testPassed("Click event was fired");
        testInput.type = "text";
    });

    testInput.addEventListener("input", () => {
        testFailed("input event should not have fired");
    });
    testInput.addEventListener("change", () => {
        testFailed("change event should not have fired");
    });
    testInput.click();
    setTimeout(finishJSTest, 0);
};
</script>
<input type="checkbox" id="testInput"></input>
</body>
</html>



Make sure we do not crash if the 'input' event listener changes the input type.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS Input event was fired
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE html>
<html>
<head>
<script src="../../../resources/js-test.js"></script>
</head>
<body>
<script>
description("Make sure we do not crash if the 'input' event listener changes the input type.");

onload = () => {
    testInput.addEventListener("input", () => {
        testPassed("Input event was fired");
        testInput.type = "text";
    });
    testInput.addEventListener("change", () => {
        testFailed("change event should not have fired");
    });
    testInput.click();
    setTimeout(finishJSTest, 0);
};
</script>
<input type="checkbox" id="testInput"></input>
</body>
</html>

Return to Bug 190252

Lines 129-135 void BaseCheckableInputType::fireInputAndChangeEvents() a/Source/WebCore/html/BaseCheckableInputType.cpp_sec1
- a/Source/WebCore/html/BaseCheckableInputType.cpp -1 / +2 lines
129		129
130	element()->setTextAsOfLastFormControlChangeEvent(String());	130	element()->setTextAsOfLastFormControlChangeEvent(String());
131	element()->dispatchInputEvent();	131	element()->dispatchInputEvent();
132	element()->dispatchFormControlChangeEvent();	132	if (auto* element = this->element())
		133	element->dispatchFormControlChangeEvent();
133	}	134	}
134		135
135	} // namespace WebCore	136	} // namespace WebCore

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +16 lines
		1	2018-10-03 Chris Dumez <cdumez@apple.com>
		2
		3	Regression(r236779): Crash when changing the input element type from inside an 'input' event listener
		4	https://bugs.webkit.org/show_bug.cgi?id=190252
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Add a null check for element() after firing the 'input' event and before firing the 'change' event
		9	in case the input event listener changes the input type.
		10
		11	Tests: fast/dom/HTMLInputElement/change-type-in-click-event-listener.html
		12	fast/dom/HTMLInputElement/change-type-in-input-event-listener.html
		13
		14	* html/BaseCheckableInputType.cpp:
		15	(WebCore::BaseCheckableInputType::fireInputAndChangeEvents):
		16
1	2018-10-03 Chris Dumez <cdumez@apple.com>	17	2018-10-03 Chris Dumez <cdumez@apple.com>
2		18
3	input.checked is incorrect while we're parsing its children	19	input.checked is incorrect while we're parsing its children

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +14 lines
		1	2018-10-03 Chris Dumez <cdumez@apple.com>
		2
		3	Regression(r236779): Crash when changing the input element type from inside an 'input' event listener
		4	https://bugs.webkit.org/show_bug.cgi?id=190252
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Add layout test coverage.
		9
		10	* fast/dom/HTMLInputElement/change-type-in-click-event-listener-expected.txt: Added.
		11	* fast/dom/HTMLInputElement/change-type-in-click-event-listener.html: Added.
		12	* fast/dom/HTMLInputElement/change-type-in-input-event-listener-expected.txt: Added.
		13	* fast/dom/HTMLInputElement/change-type-in-input-event-listener.html: Added.
		14
1	2018-10-03 Youenn Fablet <youenn@apple.com>	15	2018-10-03 Youenn Fablet <youenn@apple.com>
2		16
3	Enable H264 simulcast	17	Enable H264 simulcast

Line 0 a/LayoutTests/fast/dom/HTMLInputElement/change-type-in-click-event-listener-expected.txt_sec1
- a/LayoutTests/fast/dom/HTMLInputElement/change-type-in-click-event-listener-expected.txt +10 lines
	1	Make sure we do not crash if the 'click' event listener changes the input type.
	2
	3	On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
	4
	5
	6	PASS Click event was fired
	7	PASS successfullyParsed is true
	8
	9	TEST COMPLETE
	10

Line 0 a/LayoutTests/fast/dom/HTMLInputElement/change-type-in-click-event-listener.html_sec1
- a/LayoutTests/fast/dom/HTMLInputElement/change-type-in-click-event-listener.html +28 lines
	1	<!DOCTYPE html>
	2	<html>
	3	<head>
	4	<script src="../../../resources/js-test.js"></script>
	5	</head>
	6	<body>
	7	<script>
	8	description("Make sure we do not crash if the 'click' event listener changes the input type.");
	9
	10	onload = () => {
	11	testInput.addEventListener("click", () => {
	12	testPassed("Click event was fired");
	13	testInput.type = "text";
	14	});
	15
	16	testInput.addEventListener("input", () => {
	17	testFailed("input event should not have fired");
	18	});
	19	testInput.addEventListener("change", () => {
	20	testFailed("change event should not have fired");
	21	});
	22	testInput.click();
	23	setTimeout(finishJSTest, 0);
	24	};
	25	</script>
	26	<input type="checkbox" id="testInput"></input>
	27	</body>
	28	</html>

Line 0 a/LayoutTests/fast/dom/HTMLInputElement/change-type-in-input-event-listener-expected.txt_sec1
- a/LayoutTests/fast/dom/HTMLInputElement/change-type-in-input-event-listener-expected.txt +10 lines
	1	Make sure we do not crash if the 'input' event listener changes the input type.
	2
	3	On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
	4
	5
	6	PASS Input event was fired
	7	PASS successfullyParsed is true
	8
	9	TEST COMPLETE
	10