[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.19-706-ge5415e9

[ap at apple.com]

The following commit has been merged in the webkit-1.1 branch:
commit fd2bb94dd0d5d1493ba7c7a0d0f998eaeba0dd83
Author: ap at apple.com <ap at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Jan 25 20:37:43 2010 +0000

            Rubber-stamped by Geoffrey Garen.
    
            https://bugs.webkit.org/show_bug.cgi?id=34076
            An image remains accessible via form.property syntax after being removed from document.
    
            Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
    
            * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
            assertions added in the previous patch - it's mot true that m_for is always a parent; table
            parsing can reparent the image element, but m_form still needs to be set.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53813 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index e4654d6..9147834 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,5 +1,18 @@
 2010-01-25  Alexey Proskuryakov  <ap at apple.com>
 
+        Rubber-stamped by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
+        assertions added in the previous patch - it's mot true that m_for is always a parent; table
+        parsing can reparent the image element, but m_form still needs to be set.
+
+2010-01-25  Alexey Proskuryakov  <ap at apple.com>
+
         Reviewed by Geoffrey Garen.
 
         https://bugs.webkit.org/show_bug.cgi?id=34076
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index a917758..34646ad 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -209,18 +209,8 @@ void HTMLImageElement::removedFromDocument()
 
 void HTMLImageElement::insertedIntoTree(bool deep)
 {
-    if (m_form) {
-        // m_form was set by constructor. In debug builds, check that it's an ancestor indeed.
-#ifndef NDEBUG
-        for (Node* ancestor = parentNode(); /* no end condition - there must be a form ancestor */; ancestor = ancestor->parentNode()) {
-            ASSERT(ancestor);
-            if (ancestor->hasTagName(formTag)) {
-                ASSERT(m_form == static_cast<HTMLFormElement*>(ancestor));
-                break;
-            }
-        }
-#endif
-    } else {
+    if (!m_form) {
+        // m_form can be non-null if it was set in constructor.
         for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
             if (ancestor->hasTagName(formTag)) {
                 m_form = static_cast<HTMLFormElement*>(ancestor);

-- 
WebKit Debian packaging