[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
Gustavo Noronha Silva
gns at gnome.org
Thu Apr 8 02:24:10 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit e72362235578928f840d3187ee60d11e264c5315
Author: cfleizach at apple.com <cfleizach at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Wed Mar 17 00:10:13 2010 +0000
REGRESSION (r53857): Crash when tabbing to <map>
https://bugs.webkit.org/show_bug.cgi?id=36017
Reviewed by Darin Adler.
WebCore:
Test: fast/events/imagemap-norender-crash.html
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::imageElement):
LayoutTests:
Also fix the path to js-test-post.js in tab-imagemap.html.
* fast/events/imagemap-norender-crash-expected.txt: Added.
* fast/events/imagemap-norender-crash.html: Added.
* fast/events/tab-imagemap-expected.txt:
* fast/events/tab-imagemap.html:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@56094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 13863d1..47193b2 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2010-03-16 Chris Fleizach <cfleizach at apple.com>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION (r53857): Crash when tabbing to <map>
+ https://bugs.webkit.org/show_bug.cgi?id=36017
+
+ Also fix the path to js-test-post.js in tab-imagemap.html.
+
+ * fast/events/imagemap-norender-crash-expected.txt: Added.
+ * fast/events/imagemap-norender-crash.html: Added.
+ * fast/events/tab-imagemap-expected.txt:
+ * fast/events/tab-imagemap.html:
+
2010-03-16 Alexey Proskuryakov <ap at apple.com>
Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/events/imagemap-norender-crash-expected.txt b/LayoutTests/fast/events/imagemap-norender-crash-expected.txt
new file mode 100644
index 0000000..56f4349
--- /dev/null
+++ b/LayoutTests/fast/events/imagemap-norender-crash-expected.txt
@@ -0,0 +1,13 @@
+start element
+
+
+This tests tabbing to an image map link where the map might not have a renderer won't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.activeElement.id is 'area1'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/events/imagemap-norender-crash.html b/LayoutTests/fast/events/imagemap-norender-crash.html
new file mode 100644
index 0000000..7aacdd2
--- /dev/null
+++ b/LayoutTests/fast/events/imagemap-norender-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../js/resources/js-test-style.css">
+<script>
+var successfullyParsed = false;
+</script>
+<script src="../js/resources/js-test-pre.js"></script>
+<body id="body">
+
+<h1 id="header" tabindex=0>start element</h1>
+<div><img src="resources/abe.png" alt="test" style="width:679px; height:112px" usemap="#Map"></div>
+<div style="display:none"><map name="Map" id="Map"><area shape="rect" coords=coords="5,48,247,97" href="http://www.webkit.org/" target="_blank" id="area1"/></map></div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+ description("This tests tabbing to an image map link where the map might not have a renderer won't crash.");
+
+ // start at the right place
+ document.getElementById("header").focus();
+
+ // tab forward
+ eventSender.keyDown('\t');
+ shouldBe("document.activeElement.id", "'area1'");
+
+ successfullyParsed = true;
+</script>
+
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/events/tab-imagemap-expected.txt b/LayoutTests/fast/events/tab-imagemap-expected.txt
index e2ea63c..97add14 100644
--- a/LayoutTests/fast/events/tab-imagemap-expected.txt
+++ b/LayoutTests/fast/events/tab-imagemap-expected.txt
@@ -10,4 +10,7 @@ PASS document.activeElement.id is 'area3'
PASS document.activeElement.id is 'area5'
PASS document.activeElement.id is 'area6'
PASS document.activeElement.id == 'area1' || document.activeElement.id == 'body' is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
diff --git a/LayoutTests/fast/events/tab-imagemap.html b/LayoutTests/fast/events/tab-imagemap.html
index 89e61ae..753676a 100644
--- a/LayoutTests/fast/events/tab-imagemap.html
+++ b/LayoutTests/fast/events/tab-imagemap.html
@@ -52,6 +52,6 @@ var successfullyParsed = false;
successfullyParsed = true;
</script>
-<script src="../fast/js/resources/js-test-post.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
</body>
</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index e17936e..5aa2020 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-03-16 Chris Fleizach <cfleizach at apple.com>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION (r53857): Crash when tabbing to <map>
+ https://bugs.webkit.org/show_bug.cgi?id=36017
+
+ Test: fast/events/imagemap-norender-crash.html
+
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::imageElement):
+
2010-03-16 Zhenyao Mo <zmo at google.com>
Reviewed by Darin Fisher.
diff --git a/WebCore/html/HTMLMapElement.cpp b/WebCore/html/HTMLMapElement.cpp
index 9617afc..10a05d6 100644
--- a/WebCore/html/HTMLMapElement.cpp
+++ b/WebCore/html/HTMLMapElement.cpp
@@ -79,7 +79,7 @@ bool HTMLMapElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestRes
HTMLImageElement* HTMLMapElement::imageElement() const
{
- RefPtr<HTMLCollection> coll = renderer()->document()->images();
+ RefPtr<HTMLCollection> coll = document()->images();
for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
if (!curr->hasTagName(imgTag))
continue;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list