[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.20-204-g221d8e8
ap at apple.com
ap at apple.com
Wed Feb 10 22:14:48 UTC 2010
The following commit has been merged in the webkit-1.1 branch:
commit d5a796cfb67c958becb33c9b8c702e2b64cefa10
Author: ap at apple.com <ap at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Feb 4 22:12:56 2010 +0000
Reviewed by Darin Adler.
Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
https://bugs.webkit.org/show_bug.cgi?id=34520
Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
* dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
properties before attributes. Otherwise, copying "checked" property would make the cloned
node checked, unchecking original (they share a name, and are thus in the same radio group).
We do want the original to be unchecked, but we also want to know its original state in
HTMLInputElement::copyNonAttributeProperties().
* html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
won't be overridden when copying attributes.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@54372 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index d6d3d19..949ae8b 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-02-04 Alexey Proskuryakov <ap at apple.com>
+
+ Reviewed by Darin Adler.
+
+ Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+ https://bugs.webkit.org/show_bug.cgi?id=34520
+
+ * fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt: Added.
+ * fast/dom/HTMLInputElement/cloned-input-checked-state.html: Added.
+
2010-02-04 Enrica Casucci <enrica at apple.com>
Reviewed by Oliver Hunt.
diff --git a/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt
new file mode 100644
index 0000000..b6defeb
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state-expected.txt
@@ -0,0 +1,6 @@
+Test for bug 34520: Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1. Also tests actual behavior the crashing jQuery was test was checking for.
+
+1. PASS
+2. PASS
+3. PASS
+DONE
diff --git a/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state.html b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state.html
new file mode 100644
index 0000000..46c458a
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLInputElement/cloned-input-checked-state.html
@@ -0,0 +1,66 @@
+<body>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=34520">bug 34520</a>:
+Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1. Also tests actual
+behavior the crashing jQuery was test was checking for.</p>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function gc()
+{
+ if (window.GCController)
+ return GCController.collect();
+
+ for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)
+ var s = new String("abc");
+ }
+}
+
+try {
+ var div = document.createElement("div");
+ div.innerHTML = "<input type='radio' name='radiotest' checked='checked'/>";
+
+ var fragment = document.createDocumentFragment();
+ fragment.appendChild(div.firstChild);
+
+ var clonedInput = fragment.cloneNode(true).cloneNode(true).lastChild;
+ document.write((clonedInput.checked && clonedInput.getAttribute("checked") == "checked") ? "1. PASS" : "1. FAIL");
+ document.write("<br>");
+
+ // Test 2.
+ div = document.createElement("div");
+ div.innerHTML = "<input type='radio' name='radiotest' checked='checked'/>";
+ div.firstChild.checked = false;
+
+ fragment = document.createDocumentFragment();
+ fragment.appendChild(div.firstChild);
+
+ clonedInput = fragment.cloneNode(true).cloneNode(true).lastChild;
+ document.write((!clonedInput.checked && clonedInput.getAttribute("checked") == "checked") ? "2. PASS" : "2. FAIL");
+ document.write("<br>");
+
+ // Test 3.
+ div = document.createElement("div");
+ div.innerHTML = "<input type='radio' name='radiotest'/>";
+ div.firstChild.checked = true;
+
+ fragment = document.createDocumentFragment();
+ fragment.appendChild(div.firstChild);
+
+ clonedInput = fragment.cloneNode(true).cloneNode(true).lastChild;
+ document.write((clonedInput.checked && clonedInput.getAttribute("checked") == null) ? "3. PASS" : "3. FAIL");
+
+ document.write("<br>DONE");
+
+ setTimeout(function() {
+ gc();
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }, 0);
+} catch (ex) {
+ document.write("FAIL: " + ex);
+}
+</script>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 98c306f..f9eb774 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2010-02-04 Alexey Proskuryakov <ap at apple.com>
+
+ Reviewed by Darin Adler.
+
+ Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+ https://bugs.webkit.org/show_bug.cgi?id=34520
+
+ Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
+
+ * dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
+ properties before attributes. Otherwise, copying "checked" property would make the cloned
+ node checked, unchecking original (they share a name, and are thus in the same radio group).
+ We do want the original to be unchecked, but we also want to know its original state in
+ HTMLInputElement::copyNonAttributeProperties().
+
+ * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
+ Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
+ checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
+ won't be overridden when copying attributes.
+
2010-02-04 Kevin Ollivier <kevino at theolliviers.com>
[wx] Build fix after addition of Clipboard::writePlainText method.
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 729ec8d..cc8f9ef 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -113,11 +113,11 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
// This is a sanity check as HTML overloads some of the DOM methods.
ASSERT(isHTMLElement() == clone->isHTMLElement());
+ clone->copyNonAttributeProperties(this);
+
// Clone attributes.
if (namedAttrMap)
clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
-
- clone->copyNonAttributeProperties(this);
return clone.release();
}
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index d7247f0..ef2d627 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -1370,7 +1370,9 @@ void HTMLInputElement::copyNonAttributeProperties(const Element* source)
const HTMLInputElement* sourceElement = static_cast<const HTMLInputElement*>(source);
m_data.setValue(sourceElement->m_data.value());
- m_checked = sourceElement->m_checked;
+ setChecked(sourceElement->m_checked);
+ m_defaultChecked = sourceElement->m_defaultChecked;
+ m_useDefaultChecked = sourceElement->m_useDefaultChecked;
m_indeterminate = sourceElement->m_indeterminate;
HTMLFormControlElementWithState::copyNonAttributeProperties(source);
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list