[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.19-706-ge5415e9
mitz at apple.com
mitz at apple.com
Thu Feb 4 21:28:23 UTC 2010
The following commit has been merged in the webkit-1.1 branch:
commit 1a384d0068da185926c2bf66d46f88334a2cf627
Author: mitz at apple.com <mitz at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Jan 26 22:48:56 2010 +0000
<rdar://problem/7576663> Crash caused by anonymous list item
https://bugs.webkit.org/show_bug.cgi?id=34183
Reviewed by Beth Dakin.
WebCore:
Test: fast/lists/anonymous-items.html
enclosingList() and previousListItem() were DOM-based, but in order to work with anonymous
list items, they need to work with rthe render tree.
* rendering/RenderListItem.cpp:
(WebCore::isList): Factored out.
(WebCore::enclosingList): Added this variant that takes a RenderObject.
(WebCore::previousListItem): Changed to travers the render tree.
(WebCore::RenderListItem::calcValue): Use the RenderObject version of enclosingList()
(WebCore::RenderListItem::setExplicitValue): Added an assertion.
(WebCore::RenderListItem::clearExplicitValue): Ditto.
LayoutTests:
* fast/lists/anonymous-items.html: Added.
* platform/mac/fast/lists/anonymous-items-expected.checksum: Added.
* platform/mac/fast/lists/anonymous-items-expected.png: Added.
* platform/mac/fast/lists/anonymous-items-expected.txt: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53868 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1ae3f5c..c26ad3f 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-01-26 Dan Bernstein <mitz at apple.com>
+
+ Reviewed by Beth Dakin.
+
+ <rdar://problem/7576663> Crash caused by anonymous list item
+ https://bugs.webkit.org/show_bug.cgi?id=34183
+
+ * fast/lists/anonymous-items.html: Added.
+ * platform/mac/fast/lists/anonymous-items-expected.checksum: Added.
+ * platform/mac/fast/lists/anonymous-items-expected.png: Added.
+ * platform/mac/fast/lists/anonymous-items-expected.txt: Added.
+
2010-01-26 Chris Fleizach <cfleizach at apple.com>
Another attempt to get this test to pass for GTK.
diff --git a/LayoutTests/fast/lists/anonymous-items.html b/LayoutTests/fast/lists/anonymous-items.html
new file mode 100644
index 0000000..c8a8a4f
--- /dev/null
+++ b/LayoutTests/fast/lists/anonymous-items.html
@@ -0,0 +1,41 @@
+<p>
+ Tests list item numbering when there are anonymous list items.
+</p>
+<style>
+ #a:after {
+ display: list-item;
+ content: "ONE";
+ }
+
+ #b:after {
+ display: list-item;
+ content: "TWO";
+ }
+
+ #c:before {
+ display: list-item;
+ content: "ONE";
+ }
+
+ #d:before {
+ display: list-item;
+ content: "ONE";
+ }
+
+ #e:after {
+ display: list-item;
+ content: "TWO";
+ }
+
+ #f:before {
+ display: list-item;
+ content: "TWO";
+ }
+
+</style>
+<ol id="a"></ol>
+<ol id="b"><li>one</li></ol>
+<ol id="c"></ol>
+<ol id="d"><li>two</li></ol>
+<ol><li>one</li><div id="e">div</div><li>three</li></ol>
+<ol><li>one</li><div id="f">div</div><li>three</li></ol>
diff --git a/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.checksum b/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.checksum
new file mode 100644
index 0000000..7ef34d0
--- /dev/null
+++ b/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.checksum
@@ -0,0 +1 @@
+91dc6e7125bceaadc705078a7dcd7465
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.png b/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.png
new file mode 100644
index 0000000..6b3eee9
Binary files /dev/null and b/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.png differ
diff --git a/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.txt b/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.txt
new file mode 100644
index 0000000..91635b4
--- /dev/null
+++ b/LayoutTests/platform/mac/fast/lists/anonymous-items-expected.txt
@@ -0,0 +1,70 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x576
+ RenderBlock {P} at (0,0) size 784x18
+ RenderText {#text} at (0,0) size 395x18
+ text run at (0,0) width 395: "Tests list item numbering when there are anonymous list items."
+ RenderBlock {OL} at (0,34) size 784x18
+ RenderListItem at (40,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "1"
+ RenderText at (0,0) size 34x18
+ text run at (0,0) width 34: "ONE"
+ RenderBlock {OL} at (0,68) size 784x36
+ RenderListItem {LI} at (40,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "1"
+ RenderText {#text} at (0,0) size 23x18
+ text run at (0,0) width 23: "one"
+ RenderListItem at (40,18) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "2"
+ RenderText at (0,0) size 37x18
+ text run at (0,0) width 37: "TWO"
+ RenderBlock {OL} at (0,120) size 784x18
+ RenderListItem at (40,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "1"
+ RenderText at (0,0) size 34x18
+ text run at (0,0) width 34: "ONE"
+ RenderBlock {OL} at (0,154) size 784x36
+ RenderListItem at (40,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "1"
+ RenderText at (0,0) size 34x18
+ text run at (0,0) width 34: "ONE"
+ RenderListItem {LI} at (40,18) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "2"
+ RenderText {#text} at (0,0) size 24x18
+ text run at (0,0) width 24: "two"
+ RenderBlock {OL} at (0,206) size 784x72
+ RenderListItem {LI} at (40,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "1"
+ RenderText {#text} at (0,0) size 23x18
+ text run at (0,0) width 23: "one"
+ RenderBlock {DIV} at (40,18) size 744x36
+ RenderBlock (anonymous) at (0,0) size 744x18
+ RenderText {#text} at (0,0) size 20x18
+ text run at (0,0) width 20: "div"
+ RenderListItem at (0,18) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "2"
+ RenderText at (0,0) size 37x18
+ text run at (0,0) width 37: "TWO"
+ RenderListItem {LI} at (40,54) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "3"
+ RenderText {#text} at (0,0) size 31x18
+ text run at (0,0) width 31: "three"
+ RenderBlock {OL} at (0,294) size 784x72
+ RenderListItem {LI} at (40,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "1"
+ RenderText {#text} at (0,0) size 23x18
+ text run at (0,0) width 23: "one"
+ RenderBlock {DIV} at (40,18) size 744x36
+ RenderListItem at (0,0) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "2"
+ RenderText at (0,0) size 37x18
+ text run at (0,0) width 37: "TWO"
+ RenderBlock (anonymous) at (0,18) size 744x18
+ RenderText {#text} at (0,0) size 20x18
+ text run at (0,0) width 20: "div"
+ RenderListItem {LI} at (40,54) size 744x18
+ RenderListMarker at (-20,0) size 16x18: "3"
+ RenderText {#text} at (0,0) size 31x18
+ text run at (0,0) width 31: "three"
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index c972ac4..7b41a56 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2010-01-26 Dan Bernstein <mitz at apple.com>
+
+ Reviewed by Beth Dakin.
+
+ <rdar://problem/7576663> Crash caused by anonymous list item
+ https://bugs.webkit.org/show_bug.cgi?id=34183
+
+ Test: fast/lists/anonymous-items.html
+
+ enclosingList() and previousListItem() were DOM-based, but in order to work with anonymous
+ list items, they need to work with rthe render tree.
+
+ * rendering/RenderListItem.cpp:
+ (WebCore::isList): Factored out.
+ (WebCore::enclosingList): Added this variant that takes a RenderObject.
+ (WebCore::previousListItem): Changed to travers the render tree.
+ (WebCore::RenderListItem::calcValue): Use the RenderObject version of enclosingList()
+ (WebCore::RenderListItem::setExplicitValue): Added an assertion.
+ (WebCore::RenderListItem::clearExplicitValue): Ditto.
+
2010-01-26 Brian Weinstein <bweinstein at apple.com>
Reviewed by Jon Honeycutt.
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index 5a4f307..54a7dd2 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -1,7 +1,7 @@
/**
* Copyright (C) 1999 Lars Knoll (knoll at kde.org)
* (C) 1999 Antti Koivisto (koivisto at kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
* Copyright (C) 2006 Andrew Wellington (proton at wiretapped.net)
*
* This library is free software; you can redistribute it and/or
@@ -75,11 +75,16 @@ void RenderListItem::destroy()
RenderBlock::destroy();
}
+static bool isList(Node* node)
+{
+ return (node->hasTagName(ulTag) || node->hasTagName(olTag));
+}
+
static Node* enclosingList(Node* node)
{
Node* parent = node->parentNode();
for (Node* n = parent; n; n = n->parentNode())
- if (n->hasTagName(ulTag) || n->hasTagName(olTag))
+ if (isList(n))
return n;
// If there's no actual <ul> or <ol> list element, then our parent acts as
// our list for purposes of determining what other list items should be
@@ -87,22 +92,38 @@ static Node* enclosingList(Node* node)
return parent;
}
+static Node* enclosingList(const RenderObject* renderer)
+{
+ Node* node = renderer->node();
+ if (node)
+ return enclosingList(node);
+
+ renderer = renderer->parent();
+ while (renderer && !renderer->node())
+ renderer = renderer->parent();
+
+ node = renderer->node();
+ if (isList(node))
+ return node;
+
+ return enclosingList(node);
+}
+
static RenderListItem* previousListItem(Node* list, const RenderListItem* item)
{
- for (Node* node = item->node()->traversePreviousNode(); node != list; node = node->traversePreviousNode()) {
- RenderObject* renderer = node->renderer();
- if (!renderer || !renderer->isListItem())
+ for (RenderObject* renderer = item->previousInPreOrder(); renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
+ if (!renderer->isListItem())
continue;
- Node* otherList = enclosingList(node);
+ Node* otherList = enclosingList(renderer);
// This item is part of our current list, so it's what we're looking for.
if (list == otherList)
return toRenderListItem(renderer);
// We found ourself inside another list; lets skip the rest of it.
- // Use traverseNextNode() here because the other list itself may actually
+ // Use nextInPreOrder() here because the other list itself may actually
// be a list item itself. We need to examine it, so we do this to counteract
- // the traversePreviousNode() that will be done by the loop.
+ // the previousInPreOrder() that will be done by the loop.
if (otherList)
- node = otherList->traverseNextNode();
+ renderer = otherList->renderer()->nextInPreOrder();
}
return 0;
}
@@ -111,7 +132,7 @@ inline int RenderListItem::calcValue() const
{
if (m_hasExplicitValue)
return m_explicitValue;
- Node* list = enclosingList(node());
+ Node* list = enclosingList(this);
// FIXME: This recurses to a possible depth of the length of the list.
// That's not good -- we need to change this to an iterative algorithm.
if (RenderListItem* previousItem = previousListItem(list, this))
@@ -322,6 +343,8 @@ void RenderListItem::explicitValueChanged()
void RenderListItem::setExplicitValue(int value)
{
+ ASSERT(node());
+
if (m_hasExplicitValue && m_explicitValue == value)
return;
m_explicitValue = value;
@@ -332,6 +355,8 @@ void RenderListItem::setExplicitValue(int value)
void RenderListItem::clearExplicitValue()
{
+ ASSERT(node());
+
if (!m_hasExplicitValue)
return;
m_hasExplicitValue = false;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list