mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1386418 - Fix two issues in nsIFrame::HandleRelease. r=dholbert 

The frame selection changes can run script, so we need to check for the
frame itself getting destroyed. This fixes the crash as reported.

Additionally, the document check it does for pointer capture is
incorrect, it should use the composed, not uncomposed doc, so that it
works in shadow dom.

Differential Revision: https://phabricator.services.mozilla.com/D87097
This commit is contained in:
Emilio Cobos Álvarez 2020-08-14 17:36:03 +00:00
Родитель 19fd43ceda
Коммит e462454933
2 изменённых файлов: 43 добавлений и 9 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

20
layout/generic/nsIFrame.cpp
Просмотреть файл

@ -5108,8 +5108,7 @@ NS_IMETHODIMP nsIFrame::HandleRelease(nsPresContext* aPresContext,
// Also check the selection of the capturing content which might be in a
// different document.
if (!frameSelection && captureContent) {
Document* doc = captureContent->GetUncomposedDoc();
if (doc) {
if (Document* doc = captureContent->GetComposedDoc()) {
mozilla::PresShell* capturingPresShell = doc->GetPresShell();
if (capturingPresShell &&
capturingPresShell != PresContext()->GetPresShell()) {
@ -5119,15 +5118,18 @@ NS_IMETHODIMP nsIFrame::HandleRelease(nsPresContext* aPresContext,
}
if (frameSelection) {
AutoWeakFrame wf(this);
frameSelection->SetDragState(false);
frameSelection->StopAutoScrollTimer();
nsIScrollableFrame* scrollFrame = nsLayoutUtils::GetNearestScrollableFrame(
this, nsLayoutUtils::SCROLLABLE_SAME_DOC |
nsLayoutUtils::SCROLLABLE_INCLUDE_HIDDEN);
if (scrollFrame) {
// Perform any additional scrolling needed to maintain CSS snap point
// requirements when autoscrolling is over.
scrollFrame->ScrollSnap();
if (wf.IsAlive()) {
nsIScrollableFrame* scrollFrame = nsLayoutUtils::GetNearestScrollableFrame(
this, nsLayoutUtils::SCROLLABLE_SAME_DOC |
nsLayoutUtils::SCROLLABLE_INCLUDE_HIDDEN);
if (scrollFrame) {
// Perform any additional scrolling needed to maintain CSS snap point
// requirements when autoscrolling is over.
scrollFrame->ScrollSnap();
}
}
}

32
testing/web-platform/tests/input-events/select-event-drag-remove.html Normal file
Просмотреть файл

@ -0,0 +1,32 @@
<!doctype html>
<meta charset="utf-8">
<title>Drag select triggers the right event, and doesn't crash if it removes the target while at it</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/resources/testdriver.js"></script>
<script src="/resources/testdriver-vendor.js"></script>
<script src="/resources/testdriver-actions.js"></script>
<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1386418">
<style>
input {
border: 0;
padding: 0;
font: 16px/1 monospace;
}
</style>
<input type="text" value="Drag select to crash">
<script>
async_test(t => {
let input = document.querySelector("input");
input.addEventListener("select", t.step_func(function() {
input.remove();
requestAnimationFrame(() => requestAnimationFrame(() => t.done()));
}));
new test_driver.Actions()
.pointerMove(0, 0, { origin: input })
.pointerDown()
.pointerMove(40, 0, { origin: input })
.pointerUp()
.send();
}, "Drag and remove from the select event doesn't crash");
</script>