[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

ap at apple.com ap at apple.com
Thu Apr 8 01:39:28 UTC 2010


The following commit has been merged in the webkit-1.2 branch:
commit 43c5ba1f0b9a21d26f3e3f87fd86342affda2b2a
Author: ap at apple.com <ap at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Feb 4 22:12:56 2010 +0000

            Reviewed by Darin Adler.
    
            Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
            https://bugs.webkit.org/show_bug.cgi?id=34520
    
            Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
    
            * dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
            properties before attributes. Otherwise, copying "checked" property would make the cloned
            node checked, unchecking original (they share a name, and are thus in the same radio group).
            We do want the original to be unchecked, but we also want to know its original state in
            HTMLInputElement::copyNonAttributeProperties().
    
            * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
            Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
            checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
            won't be overridden when copying attributes.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@54372 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index d6d3d19..949ae8b 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-02-04  Alexey Proskuryakov  <ap at apple.com>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+        https://bugs.webkit.org/show_bug.cgi?id=34520
+
+        * fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt: Added.
+        * fast/dom/HTMLInputElement/cloned-input-checked-state.html: Added.
+
 2010-02-04  Enrica Casucci  <enrica at apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt
new file mode 100644
index 0000000..b6defeb
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt
@@ -0,0 +1,6 @@
+Test for bug 34520: Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1. Also tests actual behavior the crashing jQuery was test was checking for.
+
+1. PASS
+2. PASS
+3. PASS
+DONE
diff --git a/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state.html b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state.html
new file mode 100644
index 0000000..46c458a
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state.html
@@ -0,0 +1,66 @@
+<body>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=34520">bug 34520</a>:
+Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1. Also tests actual
+behavior the crashing jQuery was test was checking for.</p>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function gc()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)
+        var s = new String("abc");
+    }
+}
+
+try {
+    var div = document.createElement("div");
+    div.innerHTML = "<input type='radio' name='radiotest' checked='checked'/>";
+    
+    var fragment = document.createDocumentFragment();
+    fragment.appendChild(div.firstChild);
+
+    var clonedInput = fragment.cloneNode(true).cloneNode(true).lastChild;
+    document.write((clonedInput.checked && clonedInput.getAttribute("checked") == "checked") ? "1. PASS" : "1. FAIL");
+    document.write("<br>");
+
+    // Test 2.
+    div = document.createElement("div");
+    div.innerHTML = "<input type='radio' name='radiotest' checked='checked'/>";
+    div.firstChild.checked = false;
+    
+    fragment = document.createDocumentFragment();
+    fragment.appendChild(div.firstChild);
+    
+    clonedInput = fragment.cloneNode(true).cloneNode(true).lastChild;
+    document.write((!clonedInput.checked && clonedInput.getAttribute("checked") == "checked") ? "2. PASS" : "2. FAIL");
+    document.write("<br>");
+
+    // Test 3.
+    div = document.createElement("div");
+    div.innerHTML = "<input type='radio' name='radiotest'/>";
+    div.firstChild.checked = true;
+    
+    fragment = document.createDocumentFragment();
+    fragment.appendChild(div.firstChild);
+    
+    clonedInput = fragment.cloneNode(true).cloneNode(true).lastChild;
+    document.write((clonedInput.checked && clonedInput.getAttribute("checked") == null) ? "3. PASS" : "3. FAIL");
+
+    document.write("<br>DONE");
+
+    setTimeout(function() {
+        gc();
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }, 0);
+} catch (ex) {
+    document.write("FAIL: " + ex);
+}
+</script>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 98c306f..f9eb774 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2010-02-04  Alexey Proskuryakov  <ap at apple.com>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+        https://bugs.webkit.org/show_bug.cgi?id=34520
+
+        Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
+
+        * dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
+        properties before attributes. Otherwise, copying "checked" property would make the cloned
+        node checked, unchecking original (they share a name, and are thus in the same radio group).
+        We do want the original to be unchecked, but we also want to know its original state in
+        HTMLInputElement::copyNonAttributeProperties().
+
+        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
+        Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
+        checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
+        won't be overridden when copying attributes.
+
 2010-02-04  Kevin Ollivier  <kevino at theolliviers.com>
 
         [wx] Build fix after addition of Clipboard::writePlainText method.
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 729ec8d..cc8f9ef 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -113,11 +113,11 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
     // This is a sanity check as HTML overloads some of the DOM methods.
     ASSERT(isHTMLElement() == clone->isHTMLElement());
 
+    clone->copyNonAttributeProperties(this);
+
     // Clone attributes.
     if (namedAttrMap)
         clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
-
-    clone->copyNonAttributeProperties(this);
     
     return clone.release();
 }
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index d7247f0..ef2d627 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -1370,7 +1370,9 @@ void HTMLInputElement::copyNonAttributeProperties(const Element* source)
     const HTMLInputElement* sourceElement = static_cast<const HTMLInputElement*>(source);
 
     m_data.setValue(sourceElement->m_data.value());
-    m_checked = sourceElement->m_checked;
+    setChecked(sourceElement->m_checked);
+    m_defaultChecked = sourceElement->m_defaultChecked;
+    m_useDefaultChecked = sourceElement->m_useDefaultChecked;
     m_indeterminate = sourceElement->m_indeterminate;
 
     HTMLFormControlElementWithState::copyNonAttributeProperties(source);

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list