[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 13:59:46 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit f99d2ed63a9e76ff73def74e8c55c599527c5a89
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Oct 1 03:25:11 2010 +0000

    2010-09-30  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dan Bernstein.
    
            While updating :before and :after content, make sure that the generated
            container is allowed to add the child type.
            https://bugs.webkit.org/show_bug.cgi?id=46106
    
            Test: fast/css-generated-content/text-before-table-col-crash.html
    
            * rendering/RenderObjectChildList.cpp:
            (WebCore::RenderObjectChildList::updateBeforeAfterContent):
    2010-09-30  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dan Bernstein.
    
            Tests that adding text to a :before container that is styled as a
            table column group does not result in crash.
            https://bugs.webkit.org/show_bug.cgi?id=46106
    
            * fast/css-generated-content/text-before-table-col-crash-expected.txt: Added.
            * fast/css-generated-content/text-before-table-col-crash.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@68860 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 2b202dc..2d93af8 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-09-30  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Tests that adding text to a :before container that is styled as a
+        table column group does not result in crash.
+        https://bugs.webkit.org/show_bug.cgi?id=46106
+
+        * fast/css-generated-content/text-before-table-col-crash-expected.txt: Added.
+        * fast/css-generated-content/text-before-table-col-crash.html: Added.
+
 2010-09-30  Alpha Lam  <hclam at chromium.org>
 
         Not reviewed. Build fix.
diff --git a/LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt b/LayoutTests/fast/css-generated-content/text-before-table-col-crash-expected.txt
similarity index 100%
copy from LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt
copy to LayoutTests/fast/css-generated-content/text-before-table-col-crash-expected.txt
diff --git a/LayoutTests/fast/css-generated-content/text-before-table-col-crash.html b/LayoutTests/fast/css-generated-content/text-before-table-col-crash.html
new file mode 100644
index 0000000..9220331
--- /dev/null
+++ b/LayoutTests/fast/css-generated-content/text-before-table-col-crash.html
@@ -0,0 +1,19 @@
+<html>
+    <head>
+        <style>
+            div::before { 
+                display: table-column-group; 
+                content: "Before Generated Content"
+            }
+        </style>
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        </script>
+    </head>
+    <body>
+        <div>
+            PASS
+        </div>
+    </body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index b89189c..4eb1d33 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-09-30  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        While updating :before and :after content, make sure that the generated
+        container is allowed to add the child type.
+        https://bugs.webkit.org/show_bug.cgi?id=46106
+
+        Test: fast/css-generated-content/text-before-table-col-crash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
 2010-09-30  Mario Sanchez Prada  <msanchez at igalia.com>
 
         Reviewed by Daniel Bates.
diff --git a/WebCore/rendering/RenderObjectChildList.cpp b/WebCore/rendering/RenderObjectChildList.cpp
index 96ec800..c7c8e44 100644
--- a/WebCore/rendering/RenderObjectChildList.cpp
+++ b/WebCore/rendering/RenderObjectChildList.cpp
@@ -461,7 +461,10 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                 generatedContentContainer->setStyle(pseudoElementStyle);
                 owner->addChild(generatedContentContainer, insertBefore);
             }
-            generatedContentContainer->addChild(renderer);
+            if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
+                generatedContentContainer->addChild(renderer);
+            else
+                renderer->destroy();
         }
     }
 }

-- 
WebKit Debian packaging

