[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198

Mon Feb 21 00:27:18 UTC 2011

The following commit has been merged in the webkit-1.3 branch:
commit 07c23a6334dc39140693ffac2ba450225dd6431c
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Jan 31 19:00:34 2011 +0000

    2011-01-31  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dimitri Glazkov.
    
            Check the textarea node still exists in document before casting
            it to HTMLTextAreaElement.
            https://bugs.webkit.org/show_bug.cgi?id=53429
    
            Test: fast/forms/textarea-node-removed-from-document-crash.html
    
            * rendering/RenderTextControlMultiLine.cpp:
            (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
    2011-01-31  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dimitri Glazkov.
    
            Tests that we do not crash when destructing textarea renderer when its
            node is already removed from document.
            https://bugs.webkit.org/show_bug.cgi?id=53429
    
            * fast/forms/textarea-node-removed-from-document-crash-expected.txt: Added.
            * fast/forms/textarea-node-removed-from-document-crash.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77144 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index c63d809..cb1baed 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2011-01-31  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests that we do not crash when destructing textarea renderer when its
+        node is already removed from document.
+        https://bugs.webkit.org/show_bug.cgi?id=53429
+
+        * fast/forms/textarea-node-removed-from-document-crash-expected.txt: Added.
+        * fast/forms/textarea-node-removed-from-document-crash.html: Added.
+
 2011-01-31  Dan Bernstein  <mitz at apple.com>
 
         Remove expected results in mac-wk2 and win that are equal to the mac results after r77138.
diff --git a/LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash-expected.txt
similarity index 100%
copy from LayoutTests/compositing/overflow/get-transform-from-non-box-container-expected.txt
copy to LayoutTests/fast/forms/textarea-node-removed-from-document-crash-expected.txt
diff --git a/LayoutTests/fast/forms/textarea-node-removed-from-document-crash.html b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash.html
new file mode 100644
index 0000000..32f5842
--- /dev/null
+++ b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash.html
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
+    <script type="text/javascript">
+        if (window.layoutTestController)
+        {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+        
+        function runTest()
+        {
+            var elements = document.getElementsByTagNameNS('http://www.w3.org/1999/xhtml','html');
+            elements[0].textContent = "PASS";
+            
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+    </script> 
+    <xht:object>
+        <input autofocus="" onfocus="runTest();"/> 
+        <xht:textarea></xht:textarea>
+    </xht:object>
+</html>
+
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 61c2110..4322aa2 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2011-01-31  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Check the textarea node still exists in document before casting
+        it to HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=53429
+
+        Test: fast/forms/textarea-node-removed-from-document-crash.html
+
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
+
 2011-01-27  Abhishek Arya  <inferno at chromium.org>
 
         Reviewed by Dave Hyatt.
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
index 3e3ad41..0d512f3 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -38,7 +38,7 @@ RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placehol
 
 RenderTextControlMultiLine::~RenderTextControlMultiLine()
 {
-    if (node())
+    if (node() && node()->inDocument())
         static_cast<HTMLTextAreaElement*>(node())->rendererWillBeDestroyed();
 }
 

-- 
WebKit Debian packaging

