[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[hamaji at chromium.org]

The following commit has been merged in the debian/experimental branch:
commit ffafbb2275dd9f947819ffa6610650d12d0c7ba8
Author: hamaji at chromium.org <hamaji at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Oct 20 07:44:03 2010 +0000

    2010-10-20  Shinichiro Hamaji  <hamaji at chromium.org>
    
            Reviewed by Kent Tamura.
    
            absolutely positioned list in inline element crashes
            https://bugs.webkit.org/show_bug.cgi?id=45095
    
            * fast/lists/positioned-count-crash-expected.txt: Added.
            * fast/lists/positioned-count-crash.html: Added. Note that this test is failing for now.
    2010-10-20  Shinichiro Hamaji  <hamaji at chromium.org>
    
            Reviewed by Kent Tamura.
    
            absolutely positioned list in inline element crashes
            https://bugs.webkit.org/show_bug.cgi?id=45095
    
            Add a NULL check to avoid crash. The rendering result isn't ideal yet.
    
            Test: fast/lists/positioned-count-crash.html
    
            * rendering/RenderListItem.cpp:
            (WebCore::previousListItem):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@70132 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 3ccb692..4d90a9f 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-20  Shinichiro Hamaji  <hamaji at chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        absolutely positioned list in inline element crashes
+        https://bugs.webkit.org/show_bug.cgi?id=45095
+
+        * fast/lists/positioned-count-crash-expected.txt: Added.
+        * fast/lists/positioned-count-crash.html: Added. Note that this test is failing for now.
+
 2010-10-19  Yuzo Fujishima  <yuzo at google.com>
 
         Unreviewed Chromium test rebaseline.
diff --git a/LayoutTests/fast/lists/positioned-count-crash-expected.txt b/LayoutTests/fast/lists/positioned-count-crash-expected.txt
new file mode 100644
index 0000000..9fc066d
--- /dev/null
+++ b/LayoutTests/fast/lists/positioned-count-crash-expected.txt
@@ -0,0 +1,6 @@
+II
+
+
+For manual test: If you see no crash and "II II", it means this test PASS.
+FAIL list marker should be II. Was I.
+
diff --git a/LayoutTests/fast/lists/positioned-count-crash.html b/LayoutTests/fast/lists/positioned-count-crash.html
new file mode 100644
index 0000000..a62568a
--- /dev/null
+++ b/LayoutTests/fast/lists/positioned-count-crash.html
@@ -0,0 +1,19 @@
+<div>
+<span>
+<li>
+<li id="test" style="position: absolute;list-style-type: upper-roman;">II
+</div>
+
+<div>
+<br>
+<br>
+For manual test: If you see no crash and "II II", it means this test PASS.
+</div>
+
+<script src="resources/dump-list.js"></script>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        document.write(testListItemMarkerEqualsListItemText(document.getElementById("test")));
+    }
+</script>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index d1f1cf8..6fdd372 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2010-10-20  Shinichiro Hamaji  <hamaji at chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        absolutely positioned list in inline element crashes
+        https://bugs.webkit.org/show_bug.cgi?id=45095
+
+        Add a NULL check to avoid crash. The rendering result isn't ideal yet.
+
+        Test: fast/lists/positioned-count-crash.html
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+
 2010-10-19  Adam Roben  <aroben at apple.com>
 
         Remove uses of CACFContextRef and CARender* from WebCore
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index c248c5f..1f600fe 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -102,7 +102,7 @@ static Node* enclosingList(const RenderListItem* listItem)
 
 static RenderListItem* previousListItem(Node* list, const RenderListItem* item)
 {
-    for (RenderObject* renderer = item->previousInPreOrder(); renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
+    for (RenderObject* renderer = item->previousInPreOrder(); renderer && renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
         if (!renderer->isListItem())
             continue;
         Node* otherList = enclosingList(toRenderListItem(renderer));

-- 
WebKit Debian packaging