[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

Wed Apr 7 23:06:23 UTC 2010

The following commit has been merged in the webkit-1.2 branch:
commit d1ba3670675303f2a0a84ad00c11afca4e991973
Author: eric at webkit.org <eric at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Oct 26 19:19:58 2009 +0000

    2009-10-26  Rahul Kuchhal  <kuchhal at chromium.org>
    
            Reviewed by Eric Seidel.
    
            Prevent crash when optgroup element is empty.
    
            https://bugs.webkit.org/show_bug.cgi?id=30365
    
            * fast/forms/select-empty-optgroup-expected.txt: Added.
            * fast/forms/select-empty-optgroup.html: Added.
    2009-10-26  Rahul Kuchhal  <kuchhal at chromium.org>
    
            Reviewed by Eric Seidel.
    
            Prevent crash when optgroup element is empty by adding a NULL check.
    
            https://bugs.webkit.org/show_bug.cgi?id=30365
    
            Test: fast/forms/select-empty-optgroup.html
    
            * dom/SelectElement.cpp:
            (WebCore::SelectElement::appendFormData):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@50083 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index ac20830..5b77765 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2009-10-26  Rahul Kuchhal  <kuchhal at chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        * fast/forms/select-empty-optgroup-expected.txt: Added.
+        * fast/forms/select-empty-optgroup.html: Added.
+
 2009-10-26  Csaba Osztrogonác  <ossy at webkit.org>
 
         Unreviewed typo fix.
diff --git a/LayoutTests/fast/forms/select-empty-optgroup-expected.txt b/LayoutTests/fast/forms/select-empty-optgroup-expected.txt
new file mode 100644
index 0000000..e1ab757
--- /dev/null
+++ b/LayoutTests/fast/forms/select-empty-optgroup-expected.txt
@@ -0,0 +1,4 @@
+This tests submits on an empty select. If successful, there should not be a crash.
+
+
+
diff --git a/LayoutTests/fast/forms/select-empty-optgroup.html b/LayoutTests/fast/forms/select-empty-optgroup.html
new file mode 100644
index 0000000..057b1a5
--- /dev/null
+++ b/LayoutTests/fast/forms/select-empty-optgroup.html
@@ -0,0 +1,18 @@
+<head>
+<script>
+function submitForm()
+{
+    if (window.layoutTestController)
+        window.layoutTestController.dumpAsText();
+    document.getElementById("submitform").submit();
+}
+</script>
+</head>
+<body onload="submitForm();">
+<p>This tests submits on an empty select. If successful, there should not be a crash. </p>
+<form id="submitform" action="">
+<select name="bbb">
+    <optgroup label="aaa" ></optgroup>
+</select><br />
+</form>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 9a438b0..bbb6d6d 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2009-10-26  Rahul Kuchhal  <kuchhal at chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty by adding a NULL check.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        Test: fast/forms/select-empty-optgroup.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+
 2009-10-21  Steven Knight  <sgk at chromium.org>
 
         Reviewed by David Levin.
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index ac7d08f..3d2a549 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -479,12 +479,14 @@ bool SelectElement::appendFormData(SelectElementData& data, Element* element, Fo
     // We return the first one if it was a combobox select
     if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
         OptionElement* optionElement = toOptionElement(items[0]);
-        const AtomicString& value = optionElement->value();
-        if (value.isNull())
-            list.appendData(name, optionElement->text().stripWhiteSpace());
-        else
-            list.appendData(name, value);
-        successful = true;
+        if (optionElement) {
+            const AtomicString& value = optionElement->value();
+            if (value.isNull())
+                list.appendData(name, optionElement->text().stripWhiteSpace());
+            else
+                list.appendData(name, value);
+            successful = true;
+        }
     }
 
     return successful;

-- 
WebKit Debian packaging

