diff options
| author | jcivelli@chromium.org <jcivelli@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-12-02 05:18:27 +0000 |
|---|---|---|
| committer | jcivelli@chromium.org <jcivelli@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-12-02 05:18:27 +0000 |
| commit | 6da840ffba5ed810fadc8b1fe3edf65a2c65392b (patch) | |
| tree | 85d1237a32a97e4821880228d0eae3af02c9a9e0 /webkit/glue/webmenurunner_mac.mm | |
| parent | 4b7f1979c86bc02af805c4aa5deb363264b8b0cd (diff) | |
| download | chromium_src-6da840ffba5ed810fadc8b1fe3edf65a2c65392b.zip chromium_src-6da840ffba5ed810fadc8b1fe3edf65a2c65392b.tar.gz chromium_src-6da840ffba5ed810fadc8b1fe3edf65a2c65392b.tar.bz2 | |
Fix a browser crasher with negative index set on select popups.
BUG=63774
TEST=Visit http://vescam.com/select_crasher.html and try all the selects
in that page.
Review URL: http://codereview.chromium.org/5302009
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@67969 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'webkit/glue/webmenurunner_mac.mm')
| -rw-r--r-- | webkit/glue/webmenurunner_mac.mm | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/webkit/glue/webmenurunner_mac.mm b/webkit/glue/webmenurunner_mac.mm index b7e48ba..3e1376a 100644 --- a/webkit/glue/webmenurunner_mac.mm +++ b/webkit/glue/webmenurunner_mac.mm @@ -91,8 +91,7 @@ BOOL gNewNSMenuAPI; attributes:attrs]); [menuItem setAttributedTitle:attrTitle]; } - if (gNewNSMenuAPI) - [menuItem setTag:[menu_ numberOfItems] - 1]; + [menuItem setTag:[menu_ numberOfItems] - 1]; } // Reflects the result of the user's interaction with the popup menu. If NO, the @@ -113,8 +112,13 @@ BOOL gNewNSMenuAPI; withBounds:(NSRect)bounds initialIndex:(int)index { if (gNewNSMenuAPI) { - NSMenuItem* selectedItem = [menu_ itemAtIndex:index]; - [selectedItem setState:NSOnState]; + // index might be out of bounds, in which case we set no selection. + NSMenuItem* selectedItem = [menu_ itemWithTag:index]; + if (selectedItem) { + [selectedItem setState:NSOnState]; + } else { + selectedItem = [menu_ itemWithTag:0]; + } NSPoint anchor = NSMakePoint(NSMinX(bounds) + kPopupXOffset, NSMaxY(bounds)); [menu_ popUpMenuPositioningItem:selectedItem @@ -128,7 +132,9 @@ BOOL gNewNSMenuAPI; pullsDown:NO]; [button autorelease]; [button setMenu:menu_]; - [button selectItemAtIndex:index]; + // We use selectItemWithTag below so if the index is out-of-bounds nothing + // bad happens. + [button selectItemWithTag:index]; [button setFont:[NSFont menuFontOfSize:fontSize_]]; // Create a dummy view to associate the popup with, since the OS will use |