Crash when replacing parts of text inputs with content: url(...)
https://bugs.webkit.org/show_bug.cgi?id=101133
Reviewed by Kent Tamura.
Source/WebCore:
Disable directly setting content of elements in an input element's
shadow dom tree, because the setting breaks input element's behavior.
Tests: fast/forms/number/number-content-url-crash.html
fast/forms/search/search-content-url-crash.html
* css/html.css:
(input::-webkit-textfield-decoration-container):
Use important to disable overriding an input element's content
property.
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::attach):
Added ASSERTION. No content should be applied to
input::-webkit-textfield-decoration-container.
LayoutTests:
* fast/forms/number/number-content-url-crash-expected.txt: Added.
* fast/forms/number/number-content-url-crash.html: Added.
* fast/forms/search/search-content-url-crash-expected.txt: Added.
* fast/forms/search/search-content-url-crash.html: Added.
git-svn-id: svn://svn.chromium.org/blink/trunk@134584 bbb929c8-8fbe-4397-9dbb-9b2b20218538
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index 36641c3..4a1e335 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -436,6 +436,7 @@
display: -webkit-box;
-webkit-box-align: center;
-webkit-user-modify: read-only !important;
+ content: none !important;
}
input[type="search"]::-webkit-textfield-decoration-container {