[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 11:48:39 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 9afd17c4a0f2d710d6cc4b2706cabd23362def11
Author: abarth at webkit.org <abarth at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sat Aug 7 17:52:20 2010 +0000

    2010-08-07  Adam Barth  <abarth at webkit.org>
    
            Reviewed by Dimitri Glazkov.
    
            Regression: Memory corruption in tree builder
            https://bugs.webkit.org/show_bug.cgi?id=43672
    
            Turns out this ASSERT was wrong and we need the branch.  Yay for
            test-driven development.
    
            * html/HTMLTreeBuilder.cpp:
            (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
    2010-08-07  Adam Barth  <abarth at webkit.org>
    
            Reviewed by Dimitri Glazkov.
    
            Regression: Memory corruption in tree builder
            https://bugs.webkit.org/show_bug.cgi?id=43672
    
            * html5lib/resources/adoption02.dat:
            * html5lib/runner-expected-html5.txt:
            * html5lib/runner-expected.txt:
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@64913 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a8ac09e..b5ff0ef 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-08-07  Adam Barth  <abarth at webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Regression: Memory corruption in tree builder
+        https://bugs.webkit.org/show_bug.cgi?id=43672
+
+        * html5lib/resources/adoption02.dat:
+        * html5lib/runner-expected-html5.txt:
+        * html5lib/runner-expected.txt:
+
 2010-08-07  Dimitri Glazkov  <dglazkov at chromium.org>
 
         [Chromium]: Added port-specific expectations after http://trac.webkit.org/changeset/64901.
diff --git a/LayoutTests/html5lib/resources/adoption02.dat b/LayoutTests/html5lib/resources/adoption02.dat
index 2121e31..e6e6826 100644
--- a/LayoutTests/html5lib/resources/adoption02.dat
+++ b/LayoutTests/html5lib/resources/adoption02.dat
@@ -37,3 +37,18 @@
 |           <script>
 |             "document.getElementById("b").id = "c";document.getElementById("i").id = "j""
 |         "4"
+
+#data
+<a><div><style></style><address><a>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <a>
+|     <div>
+|       <a>
+|         <style>
+|       <address>
+|         <a>
+|         <a>
diff --git a/LayoutTests/html5lib/runner-expected-html5.txt b/LayoutTests/html5lib/runner-expected-html5.txt
index 03e7863..ac019ff 100644
--- a/LayoutTests/html5lib/runner-expected-html5.txt
+++ b/LayoutTests/html5lib/runner-expected-html5.txt
@@ -332,7 +332,7 @@ Expected:
 resources/adoption02.dat:
 2
 
-Test 2 of 2 in resources/adoption02.dat failed. Input:
+Test 2 of 3 in resources/adoption02.dat failed. Input:
 <b id="b">1<i id="i">2<p>3<script>document.getElementById("b").id = "c";document.getElementById("i").id = "j"</script></b>4
 Got:
 | <html>
diff --git a/LayoutTests/html5lib/runner-expected.txt b/LayoutTests/html5lib/runner-expected.txt
index 3d208f9..14d3ea5 100644
--- a/LayoutTests/html5lib/runner-expected.txt
+++ b/LayoutTests/html5lib/runner-expected.txt
@@ -331,7 +331,7 @@ Expected:
 resources/adoption02.dat:
 2
 
-Test 2 of 2 in resources/adoption02.dat failed. Input:
+Test 2 of 3 in resources/adoption02.dat failed. Input:
 <b id="b">1<i id="i">2<p>3<script>document.getElementById("b").id = "c";document.getElementById("i").id = "j"</script></b>4
 Got:
 | <html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 61b7c0a..7614d9e 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-08-07  Adam Barth  <abarth at webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Regression: Memory corruption in tree builder
+        https://bugs.webkit.org/show_bug.cgi?id=43672
+
+        Turns out this ASSERT was wrong and we need the branch.  Yay for
+        test-driven development.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
 2010-08-07  Dirk Schulze  <krit at webkit.org>
 
         Unreviewed build-fix.
diff --git a/WebCore/html/HTMLTreeBuilder.cpp b/WebCore/html/HTMLTreeBuilder.cpp
index 83f49fe..21716e3 100644
--- a/WebCore/html/HTMLTreeBuilder.cpp
+++ b/WebCore/html/HTMLTreeBuilder.cpp
@@ -1744,8 +1744,9 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
         //        be in HTMLConstructionSite.  My guess is that steps 8--12
         //        should all be in some HTMLConstructionSite function.
         furthestBlockElement->parserAddChild(newElement);
-        if (furthestBlockElement->attached()) {
-            ASSERT(!newElement->attached());
+        if (furthestBlockElement->attached() && !newElement->attached()) {
+            // Notice that newElement might already be attached if, for example, one of the reparented
+            // children is a style element, which attaches itself automatically.
             newElement->attach();
         }
         // 11

-- 
WebKit Debian packaging

