=== WebCore-417.24 === 2006-03-13 Timothy Hatcher <timothy@apple.com> Merged fix from TOT to Safari-2-0-branch 2006-02-16 Tim Omernick <timo@apple.com> Reviewed by Geoff. <rdar://problem/4428609> Flash Player 8.0.22 can crash Safari (and WebKit apps) with javascript disabled (7015) Added a test case, manual-tests/NPN_Invoke. This is a skeleton of a Netscape plugin which uses NPN_Invoke() to call the window.alert() JavaScript function. * bridge/mac/MacFrame.mm: (WebCore::MacFrame::windowScriptNPObject): Removed the check Darin added to return 0 when JavaScript is disabled. This method cannot return 0, because plugins are not guaranteed to check for that. Removed my old fix for Radar 4428609 (7015) in favor of a better solution. Instead of creating a "dummy" JSObject to represent the window script object when JavaScript is disabled, we use the new JavaScriptCore bindings API to create a "no script" NPObject. This solution is better because it does not cause entry into any JavaScript interpreter code. * manual-tests/NPN_Invoke: Added. * manual-tests/NPN_Invoke/English.lproj: Added. * manual-tests/NPN_Invoke/English.lproj/Localized.r: Added. * manual-tests/NPN_Invoke/Info.plist: Added. * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj: Added. * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj: Added. * manual-tests/NPN_Invoke/main.c: Added. * manual-tests/NPN_Invoke/test.html: Added. === WebCore-417.23 === 2006-03-02 Timothy Hatcher <timothy@apple.com> Merged fix from TOT to Safari-2-0-branch This also includes the http://bugzilla.opendarwin.org/show_bug.cgi?id=7363 fix <rdar://problem/4462712> REGRESSION (r12872): Repro crash when clicking the Quick Reply box in Gmail 2006-02-17 Vicki Murley <vicki@apple.com> Reviewed by Justin. Get rid of handleFocusOut on text fields and textareas - move this functionality to the place where we resign focus on the previous node in setFocusNode. Add isTextField on RenderObject as one way to distinguish from contenteditable elements - Win IE does not fire onChange for contenteditable elements, so we won't either. Also, expose the dirty bit variables previously checked in handleFocusOut methods in isEdited() and setEdited(). Fixes the following bugs: <rdar://problem/4315673> REGRESSION (1.2.2 - 1.3): onChange and onFocus events firing order differs for mouse click and tab (7227) <rdar://problem/4447009> for text fields, onChange should fire before onBlur to match Win IE Test case is on the way. * dom/DocumentImpl.cpp: (WebCore::DocumentImpl::setFocusNode): For textareas and text fields, fire a change event on the node that is resigning focus. Make sure the blur event fires after the change event - 4447009. * rendering/render_form.cpp: (WebCore::RenderLineEdit::slotReturnPressed): Replace call to handleFocusOut with equivalent code. (WebCore::RenderLineEdit::isEdited): Added. (WebCore::RenderLineEdit::setEdited): Added. (WebCore::RenderTextArea::setEdited): Added. * rendering/render_form.h: (WebCore::RenderLineEdit::isTextField): Added. (WebCore::RenderTextArea::isTextArea): Make this non-virtual. (WebCore::RenderTextArea::isEdited): Added. * rendering/render_object.h: (WebCore::RenderObject::isEdited): Added. (WebCore::RenderObject::setEdited): Added. (WebCore::RenderObject::isTextField): Added. * rendering/render_replaced.h: Remove handleFocusOut(). * rendering/render_replaced.cpp: Ditto. (WebCore::RenderWidget::eventFilter): Remove call to handleFocusOut(). Safe to do here, since we call setFocusNode immediately beforehand. === WebCore-417.22 === 2006-02-15 Timothy Hatcher <timothy@apple.com> Reviewed by Beth, Geoff, Maciej. Removed #define MALLOC_FAILURE_ACTION abort() letting malloc return NULL Fixes <rdar://problem/4365248> *SecUpd: Tiger* SureSec si#182 safari heap overflow. <rdar://problem/4416122> *SecUpd: Chardonnay* SureSec si#182 safari heap overflow. * khtml/misc/main_thread_malloc.cpp: === WebCore-417.21 === 2006-02-10 Eric Seidel <eseidel@apple.com> Reviewed by darin. <rdar://problem/4145813> hang in XMLHttpRequest::cancelRequests No test case possible. * khtml/ecma/xmlhttprequest.cpp: (KJS::removeFromRequestsByDocument): (KJS::XMLHttpRequest::removeFromRequestsByDocument): (KJS::XMLHttpRequest::cancelRequests): 2006-02-10 Timothy Hatcher <timothy@apple.com> Reviewed by Tim O. Rolling out r11800 and reworked Tim's original fix to call _NPN_DeallocateObject in the destructor. * kwq/KWQKHTMLPart.mm: (KWQKHTMLPart::~KWQKHTMLPart): (KWQKHTMLPart::setView): (KWQKHTMLPart::cleanupPluginRootObjects): === WebCore-417.20 === 2006-02-06 Timothy Hatcher <timothy@apple.com> Merged fix from TOT to Safari-2-0-branch 2005-11-01 Justin Garcia <justin.garcia@apple.com> Reviewed by darin Fixes <rdar://problem/4074536> Seed: Mail crash adjusting quote level - KHTMLPart::computeAndSetTypingStyle No test cases added, requires Mail * kwq/WebCoreBridge.mm: (-[WebCoreBridge typingStyle]): Crashes were happening after a style was merged with itself. Mail was doing a setTypingStyle with a pointer to our internal typing style. Fix is to only hand out copies of our typingStyle. 2006-02-06 Timothy Hatcher <timothy@apple.com> Merged fix from TOT to Safari-2-0-branch 2006-01-16 Tim Omernick <timo@apple.com> Reviewed by John Sullivan. WebCore part of <rdar://problem/4211707> NPAPI ref count behavior differs with Mozilla * bridge/mac/MacFrame.mm: (MacFrame::setView): Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window script object properly. Our old NPN_GetValue() did not properly retain the returned window script object. Because of this, many plugins have WebKit-specific workarounds to not release said window script object. Forcibly deallocating it here should prevent any such issues. This shouldn't cause any problems for plugins, since they should already be stopped and destroyed at this point. This also fixes a preexisting leak of the window script NPObject -- it was never actually being freed! === WebCore-417.19 === 2006-01-18 Timothy Hatcher <timothy@apple.com> Merged fix from TOT to Safari-2-0-branch 2006-01-17 Beth Dakin <bdakin@apple.com> Reviewed by Hyatt and Darin Fix for <rdar://problem/4405836> REGRESSION: crash at webmail.aol.com when deleting mail in khtml::RenderTableCell::collapsedBottomBorder() const + 232 RenderTableCell::collapsedBottomBorder() gets nextCell by calling table()->cellBelow(this). In the case of the crash, cellBelow() returns a pointer to a table cell that was already destroyed. cellBelow() thinks that the pointer is still good because the grid of cells has not been updated because all of this code is called through the hitTest and the hitTest does not update the layout. The fix that I have is simply it have the hitTest call updateLayout(). This is the only change in behavior. The rest of the patch preserves behavior for simulated clicks. fast/events/stopPropagation-submit caught this problem that arose from calling updateLayout() in the hitTest; we should always have an x and y position of 0 for simulated clicks. This preserves that behavior by keeping track of whether a click is simulated or not. * khtml/html/HTMLInputElementImpl.cpp: (DOM::HTMLInputElementImpl::defaultEventHandler): If the click is simulated, set xPos and yPos to 0. * khtml/html/html_elementimpl.cpp: (HTMLElementImpl::setContentEditable): Fix spacing. (HTMLElementImpl::click): It isn't necessary to check if there is a renderer. * khtml/rendering/render_layer.cpp: (khtml::RenderLayer::hitTest): Call updateLayout(). * khtml/xml/NodeImpl.cpp: (WebCore::NodeImpl::dispatchSimulatedMouseEvent): Set isSimulated to true. (WebCore::NodeImpl::dispatchMouseEvent): Keep track of isSimulated. * khtml/xml/NodeImpl.h: Same. * khtml/xml/dom2_eventsimpl.cpp: (DOM::MouseRelatedEventImpl::MouseRelatedEventImpl): Add isSimulated to MouseRelatedEventImpl(). (DOM::MouseRelatedEventImpl::computePositions): Only change the offsets if it's not simulated. (DOM::MouseEventImpl::MouseEventImpl): Add isSimulated to MouseEventImpl() * khtml/xml/dom2_eventsimpl.h: (DOM::MouseRelatedEventImpl::isSimulated): Declarations of isSimulated (DOM::MouseEventImpl::isSimulated): Same. === WebCore-417.18.1 === 2006-01-05 Adele Peterson <adele@apple.com> Merged fix from TOT to Safari-2-0-branch 2005-10-25 Beth Dakin <bdakin@apple.com> Reviewed by Maciej Fix for <rdar://problem/4148730> SureSec si#182 safari heap overflow. When a table has a really huge rowSpan, Safari used to crash because the malloc of the grid for the table failed. This fix just checks for the success of the malloc. * khtml/rendering/render_table.cpp: (RenderTableSection::ensureRows): Return false if the grid resize is not successful. (RenderTableSection::addCell): Return early if ensureRows() returned false. * khtml/rendering/render_table.h: Make ensureRows() return a bool instead of void. === WebCore-417.18 === 2005-12-23 Geoffrey Garen <ggaren@apple.com> - Fixed <rdar://problem/4392583> REGRESSION: Reproducible crash while viewing Opera's "why we're better than Safari" site, http://www.howtocreate.co.uk/browserSpeed.html, in khtml::RenderBlock::nodeAtPoint Fix by Darin, reviewed and landed by me. * khtml/rendering/render_container.cpp: (RenderContainer::updatePseudoChild): Don't have the parent call removeChild, because the child calls parent()->removeChild() on itself in detach(). === WebCore-417.17 === 2005-12-21 Adele Peterson <adele@apple.com> Reviewed by Tim Hatcher. Fix for <rdar://problem/4387433> Seed: Radio buttons behave incorrectly in Gmail settings * khtml/html/html_formimpl.cpp: (DOM::HTMLFormElementImpl::registerFormElement): If this form element is already checked in the default form, remove it from m_selectedRadioButtons and add it for the new form. === WebCore-417.16 === 2005-12-20 Adele Peterson <adele@apple.com> Reviewed by Darin. Fix for <rdar://problem/4387630> REGRESSION: <select> element's onClick event doesn't fire @ bugweb.apple.com * kwq/KWQKHTMLPart.mm: (KWQKHTMLPart::passSubframeEventToSubframe): only pass mouse down for khtmlviews. == Rolled over to ChangeLog-2005-12-19 ==