[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.3-2-25-gb2c19be

Mon Sep 6 13:09:39 UTC 2010

The following commit has been merged in the debian/unstable branch:
commit 39f4ec0146af0102c241d876ebb8a03b61570401
Author: jschuh at chromium.org <jschuh at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Jul 1 16:55:06 2010 +0000

    2010-07-01  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Dan Bernstein.
    
            Prevent crash on counter destruction
            https://bugs.webkit.org/show_bug.cgi?id=40032
    
            Added counter destruction to RenderWidget::destroy()
    
            Test: fast/css/counters/destroy-counter-crash.html
    
            * rendering/RenderWidget.cpp:
            (WebCore::RenderWidget::destroy):
    2010-07-01  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Dan Bernstein.
    
            Prevent crash on counter destruction
            https://bugs.webkit.org/show_bug.cgi?id=40032
    
            * fast/css/counters/destroy-counter-crash-expected.txt: Added.
            * fast/css/counters/destroy-counter-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@62271 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index fc487a0..33df148 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-07-01  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Prevent crash on counter destruction
+        https://bugs.webkit.org/show_bug.cgi?id=40032
+
+        * fast/css/counters/destroy-counter-crash-expected.txt: Added.
+        * fast/css/counters/destroy-counter-crash.html: Added.
+
 2010-06-29  Dan Bernstein  <mitz at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/css/counters/destroy-counter-crash-expected.txt b/LayoutTests/fast/css/counters/destroy-counter-crash-expected.txt
new file mode 100644
index 0000000..f8498d0
--- /dev/null
+++ b/LayoutTests/fast/css/counters/destroy-counter-crash-expected.txt
@@ -0,0 +1,2 @@
+This test is to ensure that we do not crash when destroying counter nodes.
+TEST PASSED
diff --git a/LayoutTests/fast/css/counters/destroy-counter-crash.html b/LayoutTests/fast/css/counters/destroy-counter-crash.html
new file mode 100644
index 0000000..9601c96
--- /dev/null
+++ b/LayoutTests/fast/css/counters/destroy-counter-crash.html
@@ -0,0 +1,29 @@
+<html>
+  <head>
+    <style type="text/css">
+    div { counter-reset: c }
+    iframe { counter-reset: c }
+    h1:after { content: counter(c) }
+    </style>
+    <script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    window.onload = function () {
+        var testElement = document.getElementById("test");
+        document.body.removeChild(testElement);
+        var p = document.createElement("p");
+        p.appendChild(document.createTextNode("TEST PASSED"));
+        document.body.appendChild(p);
+    }
+    </script>
+  </head>
+  <body>
+  This test is to ensure that we do not crash when destroying counter nodes.
+    <div id="test">
+      <iframe/>
+      <h1/>
+    </div>
+  </body>
+</html>
+ 
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index bd18dc4..3429101 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2010-07-01  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Prevent crash on counter destruction
+        https://bugs.webkit.org/show_bug.cgi?id=40032
+
+        Added counter destruction to RenderWidget::destroy()
+
+        Test: fast/css/counters/destroy-counter-crash.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
 2010-06-29  Dan Bernstein  <mitz at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 96a2731..53eda2e 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -27,6 +27,7 @@
 #include "AnimationController.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "RenderCounter.h"
 #include "RenderView.h"
 #include "RenderWidgetProtector.h"
 
@@ -114,6 +115,9 @@ void RenderWidget::destroy()
     if (RenderView* v = view())
         v->removeWidget(this);
 
+    if (m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(this);
+    
     if (AXObjectCache::accessibilityEnabled()) {
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);

-- 
WebKit Debian packaging

