[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
eric at webkit.org
eric at webkit.org
Wed Apr 7 23:17:32 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit 48ccc3b55794bcdddd10857a4778f6a2b9c59fa6
Author: eric at webkit.org <eric at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Sun Nov 1 16:03:27 2009 +0000
2009-11-01 Yuta Kitamura <yutak at chromium.org>
Reviewed by Darin Adler.
Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
[Crash (debug)] Combination of list-item and :after causes assertion failure
https://bugs.webkit.org/show_bug.cgi?id=30944
* fast/css/list-item-pseudo-nocrash-expected.txt: Added.
* fast/css/list-item-pseudo-nocrash.html: Added.
2009-11-01 Yuta Kitamura <yutak at chromium.org>
Reviewed by Darin Adler.
Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
[Crash (debug)] Combination of list-item and :after causes assertion failure
https://bugs.webkit.org/show_bug.cgi?id=30944
Test: fast/css/list-item-pseudo-nocrash.html
* rendering/RenderObjectChildList.cpp:
(WebCore::RenderObjectChildList::updateBeforeAfterContent):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@50386 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index bc6efc7..5a6285c 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2009-11-01 Yuta Kitamura <yutak at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+ [Crash (debug)] Combination of list-item and :after causes assertion failure
+ https://bugs.webkit.org/show_bug.cgi?id=30944
+
+ * fast/css/list-item-pseudo-nocrash-expected.txt: Added.
+ * fast/css/list-item-pseudo-nocrash.html: Added.
+
2009-11-01 Philippe Normand <pnormand at igalia.com>
Reviewed by Eric Seidel.
diff --git a/LayoutTests/fast/css/list-item-pseudo-nocrash-expected.txt b/LayoutTests/fast/css/list-item-pseudo-nocrash-expected.txt
new file mode 100644
index 0000000..01a31c2
--- /dev/null
+++ b/LayoutTests/fast/css/list-item-pseudo-nocrash-expected.txt
@@ -0,0 +1,3 @@
+This is a test for bug 30944. Passes if it does not crash.
+
+Hover me
diff --git a/LayoutTests/fast/css/list-item-pseudo-nocrash.html b/LayoutTests/fast/css/list-item-pseudo-nocrash.html
new file mode 100644
index 0000000..bb01236
--- /dev/null
+++ b/LayoutTests/fast/css/list-item-pseudo-nocrash.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <title>List-item + :after pseudo-class</title>
+ <style type="text/css">
+#anchor {
+ display: block;
+}
+#anchor:hover {}
+#anchor:after {
+ content: ".";
+ display: block;
+}
+span {
+ float: left;
+}
+ </style>
+ <script type="application/javascript">
+function run() {
+ if (!window.layoutTestController)
+ return;
+
+ window.layoutTestController.dumpAsText();
+ window.layoutTestController.waitUntilDone();
+ window.eventSender.mouseMoveTo(0, 0);
+ window.setTimeout(hover, 100);
+}
+
+function hover() {
+ var element = document.getElementById('text');
+ var x = element.offsetLeft + element.offsetWidth / 2;
+ var y = element.offsetTop + element.offsetHeight / 2;
+ window.eventSender.mouseMoveTo(x, y);
+ window.setTimeout(finalize, 100);
+}
+
+function finalize() {
+ window.layoutTestController.notifyDone();
+}
+
+window.addEventListener('load', run, false);
+ </script>
+ </head>
+ <body>
+ <p>This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30944">bug 30944</a>. Passes if it does not crash.</p>
+ <ul>
+ <li>
+ <a id="anchor" href="#"><span id="text">Hover me</span></a>
+ </li>
+ </ul>
+ </body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index f23a322..6e51389 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2009-11-01 Yuta Kitamura <yutak at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+ [Crash (debug)] Combination of list-item and :after causes assertion failure
+ https://bugs.webkit.org/show_bug.cgi?id=30944
+
+ Test: fast/css/list-item-pseudo-nocrash.html
+
+ * rendering/RenderObjectChildList.cpp:
+ (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
2009-11-01 Philippe Normand <pnormand at igalia.com>
Reviewed by Eric Seidel.
diff --git a/WebCore/rendering/RenderObjectChildList.cpp b/WebCore/rendering/RenderObjectChildList.cpp
index 23ab98f..fa19547 100644
--- a/WebCore/rendering/RenderObjectChildList.cpp
+++ b/WebCore/rendering/RenderObjectChildList.cpp
@@ -369,9 +369,11 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
RefPtr<RenderStyle> style = RenderStyle::create();
style->inheritFrom(pseudoElementStyle);
genChild->setStyle(style.release());
- } else
- // Must be a first-letter container. updateFirstLetter() will take care of it.
- ASSERT(genChild->style()->styleType() == FIRST_LETTER);
+ } else {
+ // RenderListItem may insert a list marker here. We do not need to care about this case.
+ // Otherwise, genChild must be a first-letter container. updateFirstLetter() will take care of it.
+ ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER);
+ }
}
}
return; // We've updated the generated content. That's all we needed to do.
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list