Bug 66210 – Mouseovering to <canvas> in <summary> causes crash.

• Status: RESOLVED
• Resolution: FIXED
• Component: UI Events

[Hayato Ito]

Reported in: https://bugs.webkit.org/show_bug.cgi?id=65899#c11

It seems http://trac.webkit.org/changeset/92922 caused this regression.
I'll add a layoutest which produces this crash later.

[Hayato Ito]

Created attachment 103889 [details]
testcase of crash

[Hayato Ito]

Created attachment 103896 [details]
fix crash

[Hayato Ito]

I've uploaded a patch.

<canvas> is not related. The root cause is a <details> element, which is implemented a shadow host, but may have a <summary> element as an immediate child. There is no shadow root between them.

Please see a ChangeLog for the details.

[Hayato Ito]

Note that this patch is a quick fix for crash, restoring the original behavior of <details> element.

In this case, <details> and <summary> elements, we should not stop event dispatching at <details> element . Although <details> element is implemented as a shadow host, but this is not a 'component' from the view of users. 'mouseover' event which happens at <summary> element should not stop at <details> element and should bubble up.
I'll file another bug.

(In reply to comment #3)
> I've uploaded a patch.
> 
> <canvas> is not related. The root cause is a <details> element, which is implemented a shadow host, but may have a <summary> element as an immediate child. There is no shadow root between them.
> 
> Please see a ChangeLog for the details.

[WebKit Review Bot]

Comment on attachment 103896 [details]
fix crash

Rejecting attachment 103896 [details] from commit-queue.

Failed to run "['./Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=ec2-cq-01', '--port..." exit_code: 1

Last 500 characters of output:
92cc563e0f9bf6e10618b1a3395c8d734919f55f
r93076 = 14746311153815a4f4f6a47091eb105069cfb1f0
Done rebuilding .git/svn/refs/remotes/origin/master/.rev_map.268f45cc-cd09-0410-ab3c-d52691b4dbfc
First, rewinding head to replay your work on top of it...
Fast-forwarded master to refs/remotes/origin/master.
Updating chromium port dependencies using gclient...

________ running '/usr/bin/python gyp_webkit' in '/mnt/git/webkit-commit-queue/Source/WebKit/chromium'
Updating webkit projects from gyp files...

Full output: http://queues.webkit.org/results/9394691

[Hayato Ito]

Committed r93079: <http://trac.webkit.org/changeset/93079>