[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
abarth at webkit.org
abarth at webkit.org
Wed Dec 22 12:49:42 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 926400e47979c8e37bd27c24c10567314d268c4a
Author: abarth at webkit.org <abarth at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Aug 31 07:35:01 2010 +0000
2010-08-31 Adam Barth <abarth at webkit.org>
Reviewed by Eric Seidel.
Stale document crashes at multiple URLs (with new parser)
https://bugs.webkit.org/show_bug.cgi?id=44885
We're not supposed to load resources in detached documents. According
to several locations I examined, it's the job of the caller of
DocLoader to check this invariant. Like most code dealing with
detached documents, this check isn't overly consistent. At some point,
we'll need to rationalize all the different patterns here. However, at
this point, this patch appears correct because it matches what we do
for <link rel="stylesheet">.
Test: fast/dom/HTMLLinkElement/prefetch-detached.html
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::process):
* loader/DocLoader.cpp:
(WebCore::DocLoader::requestLinkPrefetch):
2010-08-31 Adam Barth <abarth at webkit.org>
Reviewed by Eric Seidel.
Stale document crashes at multiple URLs (with new parser)
https://bugs.webkit.org/show_bug.cgi?id=44885
Test what happens when you insert a link prefetch element into a
detached document.
* fast/dom/HTMLLinkElement/prefetch-detached-expected.txt: Added.
* fast/dom/HTMLLinkElement/prefetch-detached.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@66463 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index dbf743d..734ffe7 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2010-08-31 Adam Barth <abarth at webkit.org>
+
+ Reviewed by Eric Seidel.
+
+ Stale document crashes at multiple URLs (with new parser)
+ https://bugs.webkit.org/show_bug.cgi?id=44885
+
+ Test what happens when you insert a link prefetch element into a
+ detached document.
+
+ * fast/dom/HTMLLinkElement/prefetch-detached-expected.txt: Added.
+ * fast/dom/HTMLLinkElement/prefetch-detached.html: Added.
+
2010-08-31 Jian Li <jianli at chromium.org>
Reviewed by David Levin.
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/prefetch-detached-expected.txt b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-detached-expected.txt
new file mode 100644
index 0000000..44311f8
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-detached-expected.txt
@@ -0,0 +1,3 @@
+This test passes if it doesn't crash.
+
+
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/prefetch-detached.html b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-detached.html
new file mode 100644
index 0000000..2d5d76c
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-detached.html
@@ -0,0 +1,20 @@
+<body>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<html>
+<p>This test passes if it doesn't crash.</p>
+<div id="frag"></div>
+<script>
+// Fun with innerHTML.
+document.getElementById('frag').innerHTML = '<link href="prefetch.link" rel="prefetch">';
+
+// Fun with detached documents.
+var doc = document.implementation.createDocument('application/html+xml');
+var lnk = doc.createElement('link');
+lnk.setAttribute('rel', 'prefetch');
+lnk.setAttribute('href', 'prefetch.link');
+doc.documentElement.appendChild(lnk);
+</script>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index c63e0f9..d2e7007 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,25 @@
+2010-08-31 Adam Barth <abarth at webkit.org>
+
+ Reviewed by Eric Seidel.
+
+ Stale document crashes at multiple URLs (with new parser)
+ https://bugs.webkit.org/show_bug.cgi?id=44885
+
+ We're not supposed to load resources in detached documents. According
+ to several locations I examined, it's the job of the caller of
+ DocLoader to check this invariant. Like most code dealing with
+ detached documents, this check isn't overly consistent. At some point,
+ we'll need to rationalize all the different patterns here. However, at
+ this point, this patch appears correct because it matches what we do
+ for <link rel="stylesheet">.
+
+ Test: fast/dom/HTMLLinkElement/prefetch-detached.html
+
+ * html/HTMLLinkElement.cpp:
+ (WebCore::HTMLLinkElement::process):
+ * loader/DocLoader.cpp:
+ (WebCore::DocLoader::requestLinkPrefetch):
+
2010-08-31 Jian Li <jianli at chromium.org>
Reviewed by David Levin.
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index 11512d9..712f81e 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -193,7 +193,7 @@ void HTMLLinkElement::process()
ResourceHandle::prepareForURL(m_url);
#if ENABLE(LINK_PREFETCH)
- if (m_relAttribute.m_isLinkPrefetch && m_url.isValid())
+ if (m_relAttribute.m_isLinkPrefetch && m_url.isValid() && document()->frame())
document()->docLoader()->requestLinkPrefetch(m_url);
#endif
diff --git a/WebCore/loader/DocLoader.cpp b/WebCore/loader/DocLoader.cpp
index fb12861..11268f5 100644
--- a/WebCore/loader/DocLoader.cpp
+++ b/WebCore/loader/DocLoader.cpp
@@ -172,6 +172,7 @@ CachedXSLStyleSheet* DocLoader::requestXSLStyleSheet(const String& url)
#if ENABLE(LINK_PREFETCH)
CachedResource* DocLoader::requestLinkPrefetch(const String& url)
{
+ ASSERT(frame());
return requestResource(CachedResource::LinkPrefetch, url, String());
}
#endif
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list