The elements in ShadowDOM of meter or progress should not be modifiable.
https://bugs.webkit.org/show_bug.cgi?id=92199
Reviewed by Hajime Morita.
Source/WebCore:
A user can set -webkit-user-modify: read-write to the elements in Shadow DOM in a meter or progress element.
This might cause a undesired crash like Bug 65738. They should be unmodifiable.
We add default css values to elements in ShadowDOM of meter or progress to prohibit editing them.
Tests: fast/html/meter-user-modify.html
fast/html/progress-user-modify.html
* css/html.css:
Added -webkit-user-modify: read-only !important; for these elements so that they won't be
changed by a user.
(meter::-webkit-meter-bar):
(meter::-webkit-meter-optimum-value):
(meter::-webkit-meter-suboptimum-value):
(meter::-webkit-meter-even-less-good-value):
(progress::-webkit-progress-bar):
(progress::-webkit-progress-value):
LayoutTests:
* fast/html/meter-user-modify.html: Added.
* fast/html/meter-user-modify-expected.txt: Added.
* fast/html/progress-user-modify.html: Added.
* fast/html/progress-user-modify-expected.txt: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123704 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/fast/html/meter-user-modify-expected.txt b/LayoutTests/fast/html/meter-user-modify-expected.txt
new file mode 100644
index 0000000..7bb4c0c
--- /dev/null
+++ b/LayoutTests/fast/html/meter-user-modify-expected.txt
@@ -0,0 +1,7 @@
+PASS renderTreeAfterType is renderTreeBeforeType
+PASS successfullyParsed is true
+
+TEST COMPLETE
+The inner element of meter should not be deleteable.
+
+(before)(after)
