[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198

Mon Feb 21 00:27:06 UTC 2011

The following commit has been merged in the webkit-1.3 branch:
commit ef3259eb0f2e7c53d35b262b78ad52b76b3adb74
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Jan 31 18:23:47 2011 +0000

    2011-01-27  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dave Hyatt.
    
            Tests that we do not crash when adding a child in a table
            where the before child is not a table section.
            https://bugs.webkit.org/show_bug.cgi?id=53276
    
            * fast/table/before-child-non-table-section-add-table-crash-expected.txt: Added.
            * fast/table/before-child-non-table-section-add-table-crash.html: Added.
    2011-01-27  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dave Hyatt.
    
            If beforeChild is wrapped in an anonymous table section, we need to
            go the parent to find it and use it before adding childs to table.
            https://bugs.webkit.org/show_bug.cgi?id=53276
    
            We need to make sure that beforeChild's parent is "this" before calling
            RenderBox::addChild. The previous condition in while is too restrictive
            and fails to calculate the right beforeChild value when its display
            style is table caption.
            Test: fast/table/before-child-non-table-section-add-table-crash.html
    
            * rendering/RenderTable.cpp:
            (WebCore::RenderTable::addChild):
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77141 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 3e23344..992536f 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2011-01-27  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Tests that we do not crash when adding a child in a table
+        where the before child is not a table section.
+        https://bugs.webkit.org/show_bug.cgi?id=53276
+
+        * fast/table/before-child-non-table-section-add-table-crash-expected.txt: Added.
+        * fast/table/before-child-non-table-section-add-table-crash.html: Added.
+
 2011-01-31  Tony Chang  <tony at chromium.org>
 
         Reviewed by Eric Seidel.
diff --git a/LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt b/LayoutTests/fast/table/before-child-non-table-section-add-table-crash-expected.txt
similarity index 100%
copy from LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt
copy to LayoutTests/fast/table/before-child-non-table-section-add-table-crash-expected.txt
diff --git a/LayoutTests/fast/table/before-child-non-table-section-add-table-crash.html b/LayoutTests/fast/table/before-child-non-table-section-add-table-crash.html
new file mode 100644
index 0000000..a016655
--- /dev/null
+++ b/LayoutTests/fast/table/before-child-non-table-section-add-table-crash.html
@@ -0,0 +1,25 @@
+<html>
+    <body onload="runTest();">
+        <div id="table" style="display: table;">
+            <em id="em"></em>
+            <audio controls="arbitrary" style="display: table-caption;" />
+            <img id="img" />
+        </div>
+        <div id="result"></div>
+        <script type="text/javascript">
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            function runTest()
+            {
+                var img = document.getElementById('img');
+                var em = document.getElementById('em');
+                em.parentNode.replaceChild(img, em);
+                document.body.offsetTop;
+                document.body.removeChild(document.getElementById('table'));
+                
+                document.getElementById("result").innerHTML = "PASS";
+            }
+        </script>
+    </body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 20982b5..61c2110 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2011-01-27  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        If beforeChild is wrapped in an anonymous table section, we need to
+        go the parent to find it and use it before adding childs to table.
+        https://bugs.webkit.org/show_bug.cgi?id=53276
+
+        We need to make sure that beforeChild's parent is "this" before calling
+        RenderBox::addChild. The previous condition in while is too restrictive
+        and fails to calculate the right beforeChild value when its display
+        style is table caption.
+        Test: fast/table/before-child-non-table-section-add-table-crash.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+
 2011-01-31  Shane Stephens  <shanestephens at google.com>
 
         Reviewed by Simon Fraser.
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 5b18e4f..ca536bb 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -162,7 +162,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
 
     if (!wrapInAnonymousSection) {
         // If the next renderer is actually wrapped in an anonymous table section, we need to go up and find that.
-        while (beforeChild && !beforeChild->isTableSection() && !beforeChild->isTableCol() && beforeChild->style()->display() != TABLE_CAPTION)
+        while (beforeChild && beforeChild->parent() != this)
             beforeChild = beforeChild->parent();
 
         RenderBox::addChild(child, beforeChild);

-- 
WebKit Debian packaging

