[SCM] WebKit Debian packaging branch, debian/experimental, updated. debian/1.3.8-1-142-g786665c

Mon Dec 27 16:25:25 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 17eaa6ebffdc1c2664626d65d341b93969398b18
Author: bdakin at apple.com <bdakin at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Dec 20 22:57:28 2010 +0000

    WebCore: Fix for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in
    RenderMathMLSubSup::layout() because of null base
    -and corresponding-
    <rdar://problem/8712200>
    
    Reviewed by Ada Chan.
    
    Only use base inside if(base) block.
    * mathml/RenderMathMLSubSup.cpp:
    (WebCore::RenderMathMLSubSup::layout):
    
    LayoutTests: Test for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in
    RenderMathMLSubSup::layout() because of null base
    -and corresponding-
    <rdar://problem/8712200>
    
    Reviewed by Ada Chan.
    
    * mathml/empty-msubsup-crash-expected.txt: Added.
    * mathml/empty-msubsup-crash.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74370 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6a1e5d7..7fdb9f7 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-12-20  Beth Dakin  <bdakin at apple.com>
+
+        Reviewed by Ada Chan.
+
+        Test for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in 
+        RenderMathMLSubSup::layout() because of null base
+        -and corresponding-
+        <rdar://problem/8712200>
+
+        * mathml/empty-msubsup-crash-expected.txt: Added.
+        * mathml/empty-msubsup-crash.html: Added.
+
 2010-12-20  Enrica Casucci  <enrica at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/dom/Element/normalize-crash-expected.txt b/LayoutTests/mathml/empty-msubsup-crash-expected.txt
similarity index 100%
copy from LayoutTests/fast/dom/Element/normalize-crash-expected.txt
copy to LayoutTests/mathml/empty-msubsup-crash-expected.txt
diff --git a/LayoutTests/mathml/empty-msubsup-crash.html b/LayoutTests/mathml/empty-msubsup-crash.html
new file mode 100644
index 0000000..61d4904
--- /dev/null
+++ b/LayoutTests/mathml/empty-msubsup-crash.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+
+<p>This test passes if it does not crash.</p>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+    <msubsup></msubsup>
+</math>
+
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 1c8fc28..625aced 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-12-20  Beth Dakin  <bdakin at apple.com>
+
+        Reviewed by Ada Chan.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in 
+        RenderMathMLSubSup::layout() because of null base
+        -and corresponding-
+        <rdar://problem/8712200>
+
+        Only use base inside if(base) block.
+        * mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::layout):
+
 2010-12-20  Enrica Casucci  <enrica at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/mathml/RenderMathMLSubSup.cpp b/WebCore/mathml/RenderMathMLSubSup.cpp
index f4ed506..0ea6667 100644
--- a/WebCore/mathml/RenderMathMLSubSup.cpp
+++ b/WebCore/mathml/RenderMathMLSubSup.cpp
@@ -152,8 +152,7 @@ void RenderMathMLSubSup::layout()
     RenderBlock::layout();
     
     if (m_kind == SubSup) {
-        RenderObject* base = firstChild();
-        if (base) {
+        if (RenderObject* base = firstChild()) {
             int maxHeight = 0;
             RenderObject* current = base->firstChild();
             while (current) {
@@ -166,9 +165,9 @@ void RenderMathMLSubSup::layout()
             if (heightDiff < 0) 
                 heightDiff = 0;
             base->style()->setPaddingTop(Length(heightDiff, Fixed));
+            base->setNeedsLayout(true);
         }
         setNeedsLayout(true);
-        base->setNeedsLayout(true);
         RenderBlock::layout();
     }    
 }

-- 
WebKit Debian packaging

