[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
morrita at google.com
morrita at google.com
Wed Dec 22 15:29:50 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit d79a56b58bc3f59f5bdde08079cc0e3bfd31ff79
Author: morrita at google.com <morrita at google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Nov 5 01:23:54 2010 +0000
2010-11-04 MORITA Hajime <morrita at google.com>
Reviewed by Kent Tamura.
Stale reference to RenderObject held as FrameView layoutRoot
https://bugs.webkit.org/show_bug.cgi?id=48019
* fast/dom/HTMLMeterElement/meter-element-with-child-crash-expected.txt: Added.
* fast/dom/HTMLMeterElement/meter-element-with-child-crash.html: Added.
* fast/dom/HTMLProgressElement/progress-element-with-child-crash-expected.txt: Added.
* fast/dom/HTMLProgressElement/progress-element-with-child-crash.html: Added.
* platform/mac/fast/dom/HTMLMeterElement/meter-element-expected.txt:
2010-11-04 MORITA Hajime <morrita at google.com>
Reviewed by Kent Tamura.
Stale reference to RenderObject held as FrameView layoutRoot
https://bugs.webkit.org/show_bug.cgi?id=48019
<progress> and <meter> shouldn't have children of its RenderObject,
which caused unexpected result.
This change suppresses child creation to prevent it.
Tests: fast/dom/HTMLMeterElement/meter-element-with-child-crash.html
fast/dom/HTMLProgressElement/progress-element-with-child-crash.html
* rendering/RenderIndicator.h:
(WebCore::RenderIndicator::canHaveChildren):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71377 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 24b649f..1da0a05 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2010-11-04 MORITA Hajime <morrita at google.com>
+
+ Reviewed by Kent Tamura.
+
+ Stale reference to RenderObject held as FrameView layoutRoot
+ https://bugs.webkit.org/show_bug.cgi?id=48019
+
+ * fast/dom/HTMLMeterElement/meter-element-with-child-crash-expected.txt: Added.
+ * fast/dom/HTMLMeterElement/meter-element-with-child-crash.html: Added.
+ * fast/dom/HTMLProgressElement/progress-element-with-child-crash-expected.txt: Added.
+ * fast/dom/HTMLProgressElement/progress-element-with-child-crash.html: Added.
+ * platform/mac/fast/dom/HTMLMeterElement/meter-element-expected.txt:
+
2010-11-04 Martin Robinson <mrobinson at igalia.com>
Unskip some passing tests and update some baselines.
diff --git a/LayoutTests/fast/dom/HTMLMeterElement/meter-element-with-child-crash-expected.txt b/LayoutTests/fast/dom/HTMLMeterElement/meter-element-with-child-crash-expected.txt
new file mode 100644
index 0000000..eacb78e
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLMeterElement/meter-element-with-child-crash-expected.txt
@@ -0,0 +1,3 @@
+Test for Bug 48019. It is OK not to crash.
+
+
diff --git a/LayoutTests/fast/dom/HTMLMeterElement/meter-element-with-child-crash.html b/LayoutTests/fast/dom/HTMLMeterElement/meter-element-with-child-crash.html
new file mode 100644
index 0000000..6990a2a
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLMeterElement/meter-element-with-child-crash.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+<h1>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=48019">Bug 48019</a>. It is OK not to crash.</h1>
+
+<meter><isindex>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+document.designMode = "on";
+document.execCommand("SelectAll");
+document.execCommand("CreateLink", 0, 'foo');
+document.execCommand("JustifyCenter");
+</script>
+
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/HTMLProgressElement/progress-element-with-child-crash-expected.txt b/LayoutTests/fast/dom/HTMLProgressElement/progress-element-with-child-crash-expected.txt
new file mode 100644
index 0000000..eacb78e
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLProgressElement/progress-element-with-child-crash-expected.txt
@@ -0,0 +1,3 @@
+Test for Bug 48019. It is OK not to crash.
+
+
diff --git a/LayoutTests/fast/dom/HTMLProgressElement/progress-element-with-child-crash.html b/LayoutTests/fast/dom/HTMLProgressElement/progress-element-with-child-crash.html
new file mode 100644
index 0000000..a3c4e7d
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLProgressElement/progress-element-with-child-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+ <h1>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=48019">Bug 48019</a>. It is OK not to crash.</h1>
+ <progress value=50 max=100>
+ <b>
+ <menu>
+ <select autofocus>
+ </menu>
+ <input>
+ </b>
+ </progress>
+</body>
+</html>
diff --git a/LayoutTests/platform/mac/fast/dom/HTMLMeterElement/meter-element-expected.txt b/LayoutTests/platform/mac/fast/dom/HTMLMeterElement/meter-element-expected.txt
index 384f9d6..6fcad6f 100644
--- a/LayoutTests/platform/mac/fast/dom/HTMLMeterElement/meter-element-expected.txt
+++ b/LayoutTests/platform/mac/fast/dom/HTMLMeterElement/meter-element-expected.txt
@@ -4,10 +4,7 @@ layer at (0,0) size 800x600
RenderBlock {HTML} at (0,0) size 800x600
RenderBody {BODY} at (8,8) size 784x584
RenderMeter {METER} at (0,44) size 80x16
- RenderText {#text} at (0,0) size 0x0
RenderMeter {METER} at (80,0) size 10x60
- RenderBlock (anonymous) at (0,0) size 0x0
- RenderText {#text} at (0,0) size 0x0
RenderBlock {DIV} at (0,0) size 10x60
RenderBlock {DIV} at (0,18) size 10x42
RenderText {#text} at (0,0) size 0x0
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 343ffa8..864021f 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2010-11-04 MORITA Hajime <morrita at google.com>
+
+ Reviewed by Kent Tamura.
+
+ Stale reference to RenderObject held as FrameView layoutRoot
+ https://bugs.webkit.org/show_bug.cgi?id=48019
+
+ <progress> and <meter> shouldn't have children of its RenderObject,
+ which caused unexpected result.
+ This change suppresses child creation to prevent it.
+
+ Tests: fast/dom/HTMLMeterElement/meter-element-with-child-crash.html
+ fast/dom/HTMLProgressElement/progress-element-with-child-crash.html
+
+ * rendering/RenderIndicator.h:
+ (WebCore::RenderIndicator::canHaveChildren):
+
2010-11-04 Kenichi Ishibashi <bashi at google.com>
Reviewed by Kent Tamura.
diff --git a/WebCore/rendering/RenderIndicator.h b/WebCore/rendering/RenderIndicator.h
index b1f4acf..15741dc 100644
--- a/WebCore/rendering/RenderIndicator.h
+++ b/WebCore/rendering/RenderIndicator.h
@@ -35,6 +35,7 @@ protected:
virtual void layout();
virtual void updateFromElement();
virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+ virtual bool canHaveChildren() const { return false; }
virtual void layoutParts() = 0;
virtual bool shouldHaveParts() const = 0;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list