Title: [143527] branches/chromium/1364
- Revision
- 143527
- Author
- cev...@google.com
- Date
- 2013-02-20 16:02:04 -0800 (Wed, 20 Feb 2013)
Log Message
Merge 142358
BUG=173402
Review URL: https://codereview.chromium.org/12310028
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt (from rev 142358, trunk/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt) (0 => 143527)
--- branches/chromium/1364/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt 2013-02-21 00:02:04 UTC (rev 143527)
@@ -0,0 +1,6 @@
+PASS if not crashed.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
+
Copied: branches/chromium/1364/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html (from rev 142358, trunk/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html) (0 => 143527)
--- branches/chromium/1364/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html 2013-02-21 00:02:04 UTC (rev 143527)
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<a href="" ismap style="content:'bar'; display:block;"></a>
+<script>
+document.getElementsByTagName('img')[0].click();
+testPassed('if not crashed.');
+</script>
+<script src=""
+</body>
Modified: branches/chromium/1364/Source/WebCore/html/HTMLAnchorElement.cpp (143526 => 143527)
--- branches/chromium/1364/Source/WebCore/html/HTMLAnchorElement.cpp 2013-02-21 00:00:33 UTC (rev 143526)
+++ branches/chromium/1364/Source/WebCore/html/HTMLAnchorElement.cpp 2013-02-21 00:02:04 UTC (rev 143527)
@@ -136,9 +136,9 @@
if (!imageElement || !imageElement->isServerMap())
return;
+ if (!imageElement->renderer() || !imageElement->renderer()->isRenderImage())
+ return;
RenderImage* renderer = toRenderImage(imageElement->renderer());
- if (!renderer)
- return;
// FIXME: This should probably pass true for useTransforms.
FloatPoint absolutePosition = renderer->absoluteToLocal(FloatPoint(static_cast<MouseEvent*>(event)->pageX(), static_cast<MouseEvent*>(event)->pageY()));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
