Bug 66210

Summary: Mouseovering to <canvas> in <summary> causes crash.
Product: WebKit Reporter: Hayato Ito <hayato>
Component: UI EventsAssignee: Hayato Ito <hayato>
Status: RESOLVED FIXED    
Severity: Normal CC: dglazkov, dominicc, morrita, rolandsteiner, scottfr, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
testcase of crash
none
fix crash dglazkov: review+, webkit.review.bot: commit-queue-

Hayato Ito
Reported 2011-08-14 18:44:48 PDT
Reported in: https://bugs.webkit.org/show_bug.cgi?id=65899#c11 It seems http://trac.webkit.org/changeset/92922 caused this regression. I'll add a layoutest which produces this crash later.
Attachments
testcase of crash (1.96 KB, patch)
2011-08-14 18:48 PDT, Hayato Ito 		no flags
DetailsFormatted DiffDiff
fix crash (5.50 KB, patch)
2011-08-15 02:28 PDT, Hayato Ito 		dglazkov: review+
webkit.review.bot: commit-queue-
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Hayato Ito
Comment 1 2011-08-14 18:48:58 PDT
Created attachment 103889 [details] testcase of crash
Hayato Ito
Comment 2 2011-08-15 02:28:35 PDT
Created attachment 103896 [details] fix crash
Hayato Ito
Comment 3 2011-08-15 02:31:16 PDT
I've uploaded a patch. <canvas> is not related. The root cause is a <details> element, which is implemented a shadow host, but may have a <summary> element as an immediate child. There is no shadow root between them. Please see a ChangeLog for the details.
Hayato Ito
Comment 4 2011-08-15 03:29:03 PDT
Note that this patch is a quick fix for crash, restoring the original behavior of <details> element. In this case, <details> and <summary> elements, we should not stop event dispatching at <details> element . Although <details> element is implemented as a shadow host, but this is not a 'component' from the view of users. 'mouseover' event which happens at <summary> element should not stop at <details> element and should bubble up. I'll file another bug. (In reply to comment #3) > I've uploaded a patch. > > <canvas> is not related. The root cause is a <details> element, which is implemented a shadow host, but may have a <summary> element as an immediate child. There is no shadow root between them. > > Please see a ChangeLog for the details.
WebKit Review Bot
Comment 5 2011-08-15 17:57:14 PDT
Comment on attachment 103896 [details] fix crash Rejecting attachment 103896 [details] from commit-queue. Failed to run "['./Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=ec2-cq-01', '--port..." exit_code: 1 Last 500 characters of output: 92cc563e0f9bf6e10618b1a3395c8d734919f55f r93076 = 14746311153815a4f4f6a47091eb105069cfb1f0 Done rebuilding .git/svn/refs/remotes/origin/master/.rev_map.268f45cc-cd09-0410-ab3c-d52691b4dbfc First, rewinding head to replay your work on top of it... Fast-forwarded master to refs/remotes/origin/master. Updating chromium port dependencies using gclient... ________ running '/usr/bin/python gyp_webkit' in '/mnt/git/webkit-commit-queue/Source/WebKit/chromium' Updating webkit projects from gyp files... Full output: http://queues.webkit.org/results/9394691
Hayato Ito
Comment 6 2011-08-15 18:06:03 PDT
Committed r93079: <http://trac.webkit.org/changeset/93079>
Note You need to log in before you can comment on or make changes to this bug.