Crash in EventDispatcher::dispatchEvent entering a location on Google Maps
Created attachment 254318 [details] Patch
rdar://problem/20698280
Comment on attachment 254318 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=254318&action=review > Source/WebCore/ChangeLog:23 > + Hard to make a test because this is timing sensitive. No way at all? Seems so likely someone will re-break this! > Source/WebCore/dom/EventDispatcher.cpp:344 > + event->setTarget(target); > + if (!event->target()) > + return true; Seems a little strange to set the null target on the event before returning. Is that better than returning and not setting the target at all? > Source/WebCore/dom/EventDispatcher.cpp:433 > + m_path.append(std::make_unique<MouseOrFocusEventContext>(node, currentTarget, target)); Should we be doing this if currentTarget is null? > Source/WebCore/dom/EventDispatcher.cpp:436 > + m_path.append(std::make_unique<TouchEventContext>(node, currentTarget, target)); Should we be doing this if currentTarget is null? > Source/WebCore/dom/EventDispatcher.cpp:439 > + m_path.append(std::make_unique<EventContext>(node, currentTarget, target)); Should we be doing this if currentTarget is null? > Source/WebCore/page/animation/AnimationController.cpp:112 > + m_elementChangesToDispatch.removeAllMatching([element] (const Ref<Element>& currElement) { > + return &currElement.get() == element; > + }); Could we call it otherElement rather than currElement? Nicer to use words than word fragments.
Comment on attachment 254318 [details] Patch Clearing flags on attachment: 254318 Committed r185232: <http://trac.webkit.org/changeset/185232>
All reviewed patches have been landed. Closing bug.