[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 14:24:41 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit aaa78d15347b9bed5df671e3dd01b8b3e205892e
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Oct 8 00:35:51 2010 +0000

    2010-10-07  Cris Neckar  <cdn at chromium.org>
    
            Reviewed by Adam Barth.
    
            Postpone clearing the imageLoader when rendering certain fallback content for objects until after the attach().
            https://bugs.webkit.org/show_bug.cgi?id=46921
    
            Test: fast/html/object-image-nested-fallback.html
    
            * html/HTMLObjectElement.cpp:
            (WebCore::HTMLObjectElement::renderFallbackContent):
    2010-10-07  Cris Neckar  <cdn at chromium.org>
    
            Reviewed by Adam Barth.
    
            Tests for crash when multiple objects tags with bad image content are nested as fallback content.
            https://bugs.webkit.org/show_bug.cgi?id=46921
    
            * accessibility/plugin.html:
            * fast/html/object-image-nested-fallback-expected.txt: Added.
            * fast/html/object-image-nested-fallback.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@69360 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 37522fa..9ddde4f 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-10-07  Cris Neckar  <cdn at chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Tests for crash when multiple objects tags with bad image content are nested as fallback content.
+        https://bugs.webkit.org/show_bug.cgi?id=46921
+
+        * accessibility/plugin.html:
+        * fast/html/object-image-nested-fallback-expected.txt: Added.
+        * fast/html/object-image-nested-fallback.html: Added.
+
 2010-10-07  Martin Robinson  <mrobinson at igalia.com>
 
         Add some GTK+ specific baselines.
diff --git a/LayoutTests/fast/html/object-image-nested-fallback-expected.txt b/LayoutTests/fast/html/object-image-nested-fallback-expected.txt
new file mode 100644
index 0000000..c5735f2
--- /dev/null
+++ b/LayoutTests/fast/html/object-image-nested-fallback-expected.txt
@@ -0,0 +1 @@
+PASS when no crash occurs.
diff --git a/LayoutTests/fast/html/object-image-nested-fallback.html b/LayoutTests/fast/html/object-image-nested-fallback.html
new file mode 100644
index 0000000..78f0225
--- /dev/null
+++ b/LayoutTests/fast/html/object-image-nested-fallback.html
@@ -0,0 +1,13 @@
+<html>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+    <body> 
+        <object type="image/png" data="this.object.does.not.exist.dtd">
+            <object type="image/png" data="this.object.does.not.exist.dtd">
+                <object type="image/png" data="this.object.does.not.exist.dtd">PASS when no crash occurs.</object>
+            </object>
+        </object>
+    </body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index aff4f7b..cc2ecf3 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-10-07  Cris Neckar  <cdn at chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Postpone clearing the imageLoader when rendering certain fallback content for objects until after the attach().
+        https://bugs.webkit.org/show_bug.cgi?id=46921
+
+        Test: fast/html/object-image-nested-fallback.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderFallbackContent):
+
 2010-10-07  Rafael Antognolli  <antognolli at profusion.mobi>
 
         Reviewed by Kenneth Rohde Christiansen.
diff --git a/WebCore/html/HTMLObjectElement.cpp b/WebCore/html/HTMLObjectElement.cpp
index e303b52..6c1d8e8 100644
--- a/WebCore/html/HTMLObjectElement.cpp
+++ b/WebCore/html/HTMLObjectElement.cpp
@@ -363,10 +363,11 @@ void HTMLObjectElement::renderFallbackContent()
     if (m_imageLoader && m_imageLoader->image()) {
         m_serviceType = m_imageLoader->image()->response().mimeType();
         if (!isImageType()) {
-            // If we don't think we have an image type anymore, then ditch the image loader.
-            m_imageLoader.clear();        
             detach();
             attach();
+
+            // If we don't think we have an image type anymore, then ditch the image loader.
+            m_imageLoader.clear();
             return;
         }
     }

-- 
WebKit Debian packaging

