commit 2386a6a49ea992a1e859eb0296c1cc53e5772cdb
author tkent <tkent@chromium.org> Fri Feb 26 04:04:27 2016
committer Commit bot <commit-bot@chromium.org> Fri Feb 26 04:05:50 2016
tree 5034bf96e39084f45710e0f0d5dc33e82c0ba050
parent 480e2efb79e326b1bd940a795eda5f62711bfc5e

ImageInputType::ensurePrimaryContent should recreate UA shadow tree.

Once the fallback shadow tree was created, it was never recreated even if
ensurePrimaryContent was called.  Such situation happens by updating |src|
attribute.

BUG=589838

Review URL: https://codereview.chromium.org/1732753004

Cr-Commit-Position: refs/heads/master@{#377804}

third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp

diff --git a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
index ce818df..d08fff37 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
@@ -70,4 +70,17 @@
     EXPECT_EQ(String(), inputWithForm->defaultToolTip());
 }
 
+// crbug.com/589838
+TEST(HTMLInputElementTest, ImageTypeCrash)
+{
+    RefPtrWillBeRawPtr<Document> document = Document::create();
+    RefPtrWillBeRawPtr<HTMLInputElement> input = HTMLInputElement::create(*document, nullptr, false);
+    input->setAttribute(HTMLNames::typeAttr, "image");
+    input->ensureFallbackContent();
+    // Make sure ensurePrimaryContent() recreates UA shadow tree, and updating
+    // |value| doesn't crash.
+    input->ensurePrimaryContent();
+    input->setAttribute(HTMLNames::valueAttr, "aaa");
+}
+
 } // namespace blink

third_party/WebKit/Source/core/html/forms/ImageInputType.cpp

diff --git a/third_party/WebKit/Source/core/html/forms/ImageInputType.cpp b/third_party/WebKit/Source/core/html/forms/ImageInputType.cpp
index 9705409..e578147 100644
--- a/third_party/WebKit/Source/core/html/forms/ImageInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/ImageInputType.cpp
@@ -271,6 +271,9 @@
     if (!m_useFallbackContent)
         return;
     m_useFallbackContent = false;
+    if (ShadowRoot* root = element().userAgentShadowRoot())
+        root->removeChildren();
+    createShadowSubtree();
     reattachFallbackContent();
 }