Bug 119930 - input[type=range]: Fix a crash by changing input type in 'input' event handler
Summary: input[type=range]: Fix a crash by changing input type in 'input' event handler
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Forms (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ryosuke Niwa
URL:
Keywords: BlinkMergeCandidate, InRadar
Depends on:
Blocks:
 
Reported: 2013-08-16 20:28 PDT by Ryosuke Niwa
Modified: 2013-08-19 17:01 PDT (History)
5 users (show)

See Also:


Attachments
Fixes the bug (6.08 KB, patch)
2013-08-19 14:05 PDT, Ryosuke Niwa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2013-08-16 20:28:20 PDT
Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5

In SliderThumbElement::setPositionFromPoint, renderer() can be NULL
after HTMLInputElement::setValueFromRenderer, which dispatches 'input'
event. Also, make a local vairable 'input' a RefPtr just in case.

http://crbug.com/248402

I reproduced the crash in ToT WebKit.
Comment 1 Radar WebKit Bug Importer 2013-08-16 20:28:47 PDT
<rdar://problem/14763983>
Comment 2 Ryosuke Niwa 2013-08-16 20:32:19 PDT
Merging the patch isn't enough to fix crash/hang in WebKit. We'll need to investigate it further.
Comment 3 Ryosuke Niwa 2013-08-19 14:05:44 PDT
Created attachment 209119 [details]
Fixes the bug
Comment 4 Kent Tamura 2013-08-19 16:35:10 PDT
Comment on attachment 209119 [details]
Fixes the bug

ok
Comment 5 Ryosuke Niwa 2013-08-19 16:43:40 PDT
Comment on attachment 209119 [details]
Fixes the bug

Thanks for the review!
Comment 6 WebKit Commit Bot 2013-08-19 17:01:56 PDT
Comment on attachment 209119 [details]
Fixes the bug

Clearing flags on attachment: 209119

Committed r154308: <http://trac.webkit.org/changeset/154308>
Comment 7 WebKit Commit Bot 2013-08-19 17:01:58 PDT
All reviewed patches have been landed.  Closing bug.