[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 13:41:37 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 1c757af55441a4791708d9c85c32ed15e5b8eacd
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Sep 23 17:21:07 2010 +0000

    2010-09-23  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dave Hyatt.
    
            Fix the memory safety issue by checking containerObject is a RenderBox
            before doing the transforms.
            https://bugs.webkit.org/show_bug.cgi?id=46365
    
            Test: compositing/overflow/get-transform-from-non-box-container.html
    
            * rendering/RenderObject.cpp:
            (WebCore::RenderObject::getTransformFromContainer):
    2010-09-23  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dave Hyatt.
    
            Tests that we donot assert on object->isBox.
            https://bugs.webkit.org/show_bug.cgi?id=46365
    
            * compositing/overflow/get-transform-from-non-box-container-expected.txt: Added.
            * compositing/overflow/get-transform-from-non-box-container.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@68158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index d45e5aa..8053e61 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-09-23  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Tests that we donot assert on object->isBox.
+        https://bugs.webkit.org/show_bug.cgi?id=46365
+
+        * compositing/overflow/get-transform-from-non-box-container-expected.txt: Added.
+        * compositing/overflow/get-transform-from-non-box-container.html: Added.
+
 2010-09-23  Dimitri Glazkov  <dglazkov at chromium.org>
 
         Remove passing tests. These were failing because the bot was missing QuickTime.
diff --git a/LayoutTests/editing/selection/5136696-expected.txt b/LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt
similarity index 100%
copy from LayoutTests/editing/selection/5136696-expected.txt
copy to LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt
diff --git a/LayoutTests/compositing/overflow/get-transform-from-non-box-container.html b/LayoutTests/compositing/overflow/get-transform-from-non-box-container.html
new file mode 100644
index 0000000..01cc461
--- /dev/null
+++ b/LayoutTests/compositing/overflow/get-transform-from-non-box-container.html
@@ -0,0 +1,24 @@
+<html>
+    <head>
+        <style>
+            .container {
+                display: inline; 
+                -webkit-perspective: 10px; 
+            }
+            .intermediate {
+                -webkit-column-width: 100px;
+            }
+        </style>
+    </head>
+    <body>
+        <div class="container" style="position: relative">
+            <div class="intermediate" style="position: absolute">
+                PASS
+            </div>
+        </div>
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        </script>
+    </body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 59757c5..3ee4e1c 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-09-23  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix the memory safety issue by checking containerObject is a RenderBox
+        before doing the transforms.
+        https://bugs.webkit.org/show_bug.cgi?id=46365
+
+        Test: compositing/overflow/get-transform-from-non-box-container.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+
 2010-09-23  David Hyatt  <hyatt at apple.com>
 
         Reviewed by Simon Fraser.
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index e200ff9..67855cf 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -1988,7 +1988,7 @@ void RenderObject::getTransformFromContainer(const RenderObject* containerObject
         transform.multLeft(layer->currentTransform());
     
 #if ENABLE(3D_RENDERING)
-    if (containerObject && containerObject->hasLayer() && containerObject->style()->hasPerspective()) {
+    if (containerObject && containerObject->isBox() && containerObject->hasLayer() && containerObject->style()->hasPerspective()) {
         // Perpsective on the container affects us, so we have to factor it in here.
         ASSERT(containerObject->hasLayer());
         FloatPoint perspectiveOrigin = toRenderBox(containerObject)->layer()->perspectiveOrigin();

-- 
WebKit Debian packaging

