[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
mitz at apple.com
mitz at apple.com
Wed Dec 22 14:02:26 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit e37891d67b24f2a33a1570f49b45a4b411949c34
Author: mitz at apple.com <mitz at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Oct 1 19:16:25 2010 +0000
<rdar://problem/7563219> Null dereference when dragging an element with generated content
https://bugs.webkit.org/show_bug.cgi?id=47005
Reviewed by Adele Peterson.
WebCore:
Test: fast/css-generated-content/drag-state.html
* rendering/RenderObject.cpp:
(WebCore::RenderObject::updateDragState): Null-check node().
LayoutTests:
* fast/css-generated-content/drag-state-expected.txt: Added.
* fast/css-generated-content/drag-state.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@68911 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 36d4227..8e1d036 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-01 Dan Bernstein <mitz at apple.com>
+
+ Reviewed by Adele Peterson.
+
+ <rdar://problem/7563219> Null dereference when dragging an element with generated content
+ https://bugs.webkit.org/show_bug.cgi?id=47005
+
+ * fast/css-generated-content/drag-state-expected.txt: Added.
+ * fast/css-generated-content/drag-state.html: Added.
+
2010-10-01 Alpha Lam <hclam at chromium.org>
Not reviewed. Build fix.
diff --git a/LayoutTests/fast/css-generated-content/drag-state-expected.txt b/LayoutTests/fast/css-generated-content/drag-state-expected.txt
new file mode 100644
index 0000000..0e31fe9
--- /dev/null
+++ b/LayoutTests/fast/css-generated-content/drag-state-expected.txt
@@ -0,0 +1,3 @@
+Test for https://bugs.webkit.org/show_bug.cgi?id=47005 Null dereference when dragging an element with generated content.
+
+Drag the box above. The text should become blue and the browser should not crash.
diff --git a/LayoutTests/fast/css-generated-content/drag-state.html b/LayoutTests/fast/css-generated-content/drag-state.html
new file mode 100644
index 0000000..5bf27c3
--- /dev/null
+++ b/LayoutTests/fast/css-generated-content/drag-state.html
@@ -0,0 +1,22 @@
+<style>
+ #target { border: solid; -webkit-user-drag: element; width: 100px; height: 100px; }
+ #target:before { content: "Drag this"; }
+ #target:-webkit-drag:before { color: blue; }
+</style>
+<div id="target"></div>
+<p>
+ Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=47005">https://bugs.webkit.org/show_bug.cgi?id=47005</a>
+ Null dereference when dragging an element with generated content</i>.
+</p>
+<p>
+ Drag the box above. The text should become blue and the browser should not crash.
+</p>
+<script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ eventSender.mouseMoveTo(50, 50);
+ eventSender.mouseDown();
+ eventSender.mouseMoveTo(250, 250);
+ eventSender.mouseUp();
+ }
+</script>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index f20294e..41e3784 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-10-01 Dan Bernstein <mitz at apple.com>
+
+ Reviewed by Adele Peterson.
+
+ <rdar://problem/7563219> Null dereference when dragging an element with generated content
+ https://bugs.webkit.org/show_bug.cgi?id=47005
+
+ Test: fast/css-generated-content/drag-state.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::updateDragState): Null-check node().
+
2010-10-01 Robert Hogan <robert at webkit.org>
Reviewed by Adam Barth.
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 9e86dd8..8be614d 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -2224,7 +2224,7 @@ void RenderObject::updateDragState(bool dragOn)
{
bool valueChanged = (dragOn != m_isDragging);
m_isDragging = dragOn;
- if (valueChanged && style()->affectedByDragRules())
+ if (valueChanged && style()->affectedByDragRules() && node())
node()->setNeedsStyleRecalc();
for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling())
curr->updateDragState(dragOn);
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list