ChangeLog

2016-06-06  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Creating a TouchList with non Touch items should throw an exception

        https://bugs.webkit.org/show_bug.cgi?id=158302

        Reviewed by NOBODY (OOPS!).

        Only Touch items should be passed to CreateTouchList function as per specification

        (https://w3c.github.io/touch-events/#extensions-to-the-document-interface).

        CreateTouchList function behavior is modified. An exception is thrown when non Touch items

        are passed as parameters instead of adding null items in the TouchList.

        Tests have been modified to check whether behavior of CreateTouchList is correct.

        * bindings/js/JSDocumentCustom.cpp:

        (WebCore::JSDocument::createTouchList):

        * dom/Document.idl:

2016-06-05  Sam Weinig  <sam@webkit.org>

        Add experimental support for spring based CSS animations

Source/WebCore/bindings/js/JSDocumentCustom.cpp

@@JSValue JSDocument::createTouchList(ExecState& state)

{

    auto touchList = TouchList::create();

136 for (size_t i = 0; i < state.argumentCount(); i++)

137 touchList->append(JSTouch::toWrapped(state.argument(i)));

    for (size_t i = 0; i < state.argumentCount(); ++i) {

        if (!state.uncheckedArgument(i).inherits(JSTouch::info()))

            return JSValue::decode(throwArgumentTypeError(state, i, "touches", "Document", "createTouchList", "TouchList"));

138139

139 return toJS(&state, globalObject(), touchList);

        auto* item = JSTouch::toWrapped(state.argument(i));

        ASSERT(item);

        touchList->append(item);

    }

    return toJSNewlyCreated(&state, globalObject(), WTFMove(touchList));

}

#endif

Source/WebCore/dom/Document.idl

                                                   optional long webkitRadiusY = 0,

                                                   optional unrestricted float webkitRotationAngle = NaN,

                                                   optional unrestricted float webkitForce = NaN);

304 [NewObject, Custom~~, RaisesException~~] TouchList createTouchList();

304 [NewObject, Custom] TouchList createTouchList(Touch... touches);

#endif

#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT

LayoutTests/ChangeLog

2016-06-06  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Creating a TouchList with non Touch items should throw an exception

        https://bugs.webkit.org/show_bug.cgi?id=158302

        Reviewed by NOBODY (OOPS!).

        Only Touch items should be passed to CreateTouchList function as

        per specification (https://w3c.github.io/touch-events/#extensions-to-the-document-interface).

        Tests have been modified to check whether behavior of CreateTouchList is correct.

        * fast/events/touch/document-create-touch-list-crash-expected.txt:

        * fast/events/touch/document-create-touch-list-expected.txt:

        * fast/events/touch/script-tests/document-create-touch-list-crash.js:

        * fast/events/touch/script-tests/document-create-touch-list.js:

2016-06-05  Sam Weinig  <sam@webkit.org>

        Add experimental support for spring based CSS animations

LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt

@@This test ensures that WebKit doesn't crash when the document.createTouchList AP

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

PASS document.createTouchList(document).item(0) is null

PASS document.createTouchList({"a":1}).item(0) is null

PASS document.createTouchList(new Array(5)).item(0) is null

PASS document.createTouchList("string").item(0) is null

PASS document.createTouchList(null).item(0) is null

PASS document.createTouchList(undefined).item(0) is null

PASS tl.length is 3

PASS document.createTouchList(document).item(0) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS document.createTouchList({"a":1}).item(0) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS document.createTouchList(new Array(5)).item(0) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS document.createTouchList("string").item(0) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS document.createTouchList(null).item(0) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS document.createTouchList(undefined).item(0) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS document.createTouchList() did not throw exception.

PASS document.createTouchList().length is 0

PASS document.createTouchList(t, document, t2); threw exception TypeError: Argument 2 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS tl.length is 2

1316PASS tl.item(0) is non-null.

14 PASS tl.item(1) is null

15 PASS tl.item(2) is non-null.

17PASS tl.item(1) is non-null.

PASS successfullyParsed is true

TEST COMPLETE

LayoutTests/fast/events/touch/document-create-touch-list-expected.txt

@@PASS ts.touches[0].identifier is 12341

PASS ts.touches[0].clientX is 60

PASS ts.touches[1].screenY is 120

PASS ts.ctrlKey is true

20PASS document.createTouchList(1, 2) threw exception TypeError: Argument 1 ('touches') to Document.createTouchList must be an instance of TouchList.

PASS successfullyParsed is true

TEST COMPLETE

LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js

11description("This test ensures that WebKit doesn't crash when the document.createTouchList API is called with non-Touch parameters");

22

shouldBeNull('document.createTouchList(document).item(0)');

shouldBeNull('document.createTouchList({"a":1}).item(0)');

shouldBeNull('document.createTouchList(new Array(5)).item(0)');

shouldBeNull('document.createTouchList("string").item(0)');

shouldBeNull('document.createTouchList(null).item(0)');

shouldBeNull('document.createTouchList(undefined).item(0)');

shouldThrow('document.createTouchList(document).item(0)');

shouldThrow('document.createTouchList({"a":1}).item(0)');

shouldThrow('document.createTouchList(new Array(5)).item(0)');

shouldThrow('document.createTouchList("string").item(0)');

shouldThrow('document.createTouchList(null).item(0)');

shouldThrow('document.createTouchList(undefined).item(0)');

shouldNotThrow('document.createTouchList()');

shouldBe('document.createTouchList().length', '0');

var t = document.createTouch(window, document.body, 12341, 60, 65, 100, 105);

var t2 = document.createTouch(window, document.body, 12342, 50, 55, 115, 120);

12 var tl = document.createTouchList(t, document, t2);

1314

14 shouldBe('tl.length', '3');

shouldThrow('document.createTouchList(t, document, t2);');

var tl = document.createTouchList(t, t2);

shouldBe('tl.length','2');

1519shouldBeNonNull('tl.item(0)');

16 shouldBeNull('tl.item(1)');

17 shouldBeNonNull('tl.item(2)');

20shouldBeNonNull('tl.item(1)');

1821

1922isSuccessfullyParsed();

LayoutTests/fast/events/touch/script-tests/document-create-touch-list.js

@@try {

}

// Test createTouchList with invalid arguments which throws exceptions.

try {

    var tl = document.createTouchList(1, 2);

} catch(e) {

    testFailed("An exception was thrown: " + e.message);

}

40shouldThrow("document.createTouchList(1, 2)");

41

4542isSuccessfullyParsed();

4643