[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
cfleizach at apple.com
cfleizach at apple.com
Wed Dec 22 11:14:39 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 552c3ae03a627a17fadd81e3bbcadb809f82aaca
Author: cfleizach at apple.com <cfleizach at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Jul 15 21:47:38 2010 +0000
AX: Crash when table has empty thead tag
https://bugs.webkit.org/show_bug.cgi?id=42391
Reviewed by Darin Adler.
WebCore:
Test: accessibility/table-with-empty-thead-causes-crash.html
* accessibility/AccessibilityTableColumn.cpp:
(WebCore::AccessibilityTableColumn::headerObjectForSection):
LayoutTests:
* accessibility/table-with-empty-thead-causes-crash-expected.txt: Added.
* accessibility/table-with-empty-thead-causes-crash.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@63466 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 5278fcf..78e579d 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-07-15 Chris Fleizach <cfleizach at apple.com>
+
+ Reviewed by Darin Adler.
+
+ AX: Crash when table has empty thead tag
+ https://bugs.webkit.org/show_bug.cgi?id=42391
+
+ * accessibility/table-with-empty-thead-causes-crash-expected.txt: Added.
+ * accessibility/table-with-empty-thead-causes-crash.html: Added.
+
2010-07-15 Adam Barth <abarth at webkit.org>
Reviewed by Eric Seidel.
diff --git a/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt b/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt
new file mode 100644
index 0000000..be07db5
--- /dev/null
+++ b/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt
@@ -0,0 +1,10 @@
+1 2
+Construct accessibility objects for a table with an empty thread tag. This can cause a crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/table-with-empty-thead-causes-crash.html b/LayoutTests/accessibility/table-with-empty-thead-causes-crash.html
new file mode 100644
index 0000000..0d8b910
--- /dev/null
+++ b/LayoutTests/accessibility/table-with-empty-thead-causes-crash.html
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
+<script>
+ var successfullyParsed = false;
+
+ function buildAccessibilityTree(accessibilityObject) {
+ accessibilityObject.isEnabled
+
+ var count = accessibilityObject.childrenCount;
+ for (var i = 0; i < count; ++i)
+ buildAccessibilityTree(accessibilityObject.childAtIndex(i));
+ }
+</script>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+
+<table summary="table">
+ <thead>
+ </thead>
+<tr><td>1</td><td>2</td></tr>
+</table>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+ description("Construct accessibility objects for a table with an empty thread tag. This can cause a crash.");
+
+ if (window.accessibilityController) {
+ document.body.focus();
+ buildAccessibilityTree(accessibilityController.focusedElement);
+ }
+
+ successfullyParsed = true;
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index daaecba..2425fce 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-07-15 Chris Fleizach <cfleizach at apple.com>
+
+ Reviewed by Darin Adler.
+
+ AX: Crash when table has empty thead tag
+ https://bugs.webkit.org/show_bug.cgi?id=42391
+
+ Test: accessibility/table-with-empty-thead-causes-crash.html
+
+ * accessibility/AccessibilityTableColumn.cpp:
+ (WebCore::AccessibilityTableColumn::headerObjectForSection):
+
2010-07-15 Anders Carlsson <andersca at apple.com>
Reviewed by Sam Weinig.
diff --git a/WebCore/accessibility/AccessibilityTableColumn.cpp b/WebCore/accessibility/AccessibilityTableColumn.cpp
index 5872706..45137ff 100644
--- a/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -130,6 +130,9 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
if (m_columnIndex >= numCols)
return 0;
+ if (!section->numRows())
+ return 0;
+
RenderTableCell* cell = 0;
// also account for cells that have a span
for (int testCol = m_columnIndex; testCol >= 0; --testCol) {
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list