In the following code if (input->isFileUpload()) { FileList* files = input->files(); unsigned listSize = files->length(); if (files && listSize > 1) { The pointer "files" always exists if isFileUpload(). Moreover, the check is done after deferencing the pointer anyway. Fix that :)
Created attachment 83305 [details] Patch
Comment on attachment 83305 [details] Patch Clearing flags on attachment: 83305 Committed r79317: <http://trac.webkit.org/changeset/79317>
All reviewed patches have been landed. Closing bug.