Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/imported/w3c/ChangeLog (207043 => 207044)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/imported/w3c/ChangeLog 2016-10-11 06:00:21 UTC (rev 207043)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/imported/w3c/ChangeLog 2016-10-11 06:06:46 UTC (rev 207044)
@@ -1,3 +1,14 @@
+2016-09-07 Chris Dumez <[email protected]>
+
+ Fix handling of negative radius in HTMLAreaElement's coords when in circle state
+ https://bugs.webkit.org/show_bug.cgi?id=161690
+
+ Reviewed by Daniel Bates.
+
+ Rebaseline existing test now that one more check is passing.
+
+ * web-platform-tests/html/semantics/embedded-content/the-area-element/area-processing-expected.txt:
+
2016-09-03 Chris Dumez <[email protected]>
Align meta element http-equiv="refresh" parsing with the HTML specification
Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-area-element/area-processing-expected.txt (207043 => 207044)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-area-element/area-processing-expected.txt 2016-10-11 06:00:21 UTC (rev 207043)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-area-element/area-processing-expected.txt 2016-10-11 06:06:46 UTC (rev 207044)
@@ -9,7 +9,7 @@
PASS first > third, second > fourth: "10,10,2,2" (rect)
PASS negative: "-10,-10,-10,-10" (default)
PASS too few numbers: "20,40" (circle)
-FAIL negative radius: "20,40,-10" (circle) assert_equals: elementFromPoint(21, 41) expected Element node <img src="" usemap="" id="img" w... but got Element node <area id="area" shape="circle" coords="20,40,-10"></area>
+PASS negative radius: "20,40,-10" (circle)
PASS zero radius: "20,40,0" (circle)
PASS too few numbers: "100,100,120,100,100" (poly)
PASS one too many numbers: "100,100,120,100,100,120,300" (poly)
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (207043 => 207044)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-10-11 06:00:21 UTC (rev 207043)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-10-11 06:06:46 UTC (rev 207044)
@@ -1,3 +1,24 @@
+2016-09-07 Chris Dumez <[email protected]>
+
+ Fix handling of negative radius in HTMLAreaElement's coords when in circle state
+ https://bugs.webkit.org/show_bug.cgi?id=161690
+
+ Reviewed by Daniel Bates.
+
+ Fix handling of negative radius in HTMLAreaElement's coords when in
+ circle state:
+ - https://html.spec.whatwg.org/#attr-area-shape-circle
+
+ The radius must be non-negative as per the specification. However, our
+ code fails to check.
+
+ Firefox and Chrome both reject negative radius.
+
+ No new tests, rebaselined existing test.
+
+ * html/HTMLAreaElement.cpp:
+ (WebCore::HTMLAreaElement::getRegion):
+
2016-09-16 Carlos Garcia Campos <[email protected]>
[TextureMapper] Scrolling through 01.org/dleyna crashes WebKitWebProcess
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/html/HTMLAreaElement.cpp (207043 => 207044)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/html/HTMLAreaElement.cpp 2016-10-11 06:00:21 UTC (rev 207043)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/html/HTMLAreaElement.cpp 2016-10-11 06:06:46 UTC (rev 207044)
@@ -159,8 +159,9 @@
break;
case Circle:
if (m_coords.size() >= 3) {
- double r = m_coords[2];
- path.addEllipse(FloatRect(m_coords[0] - r, m_coords[1] - r, 2 * r, 2 * r));
+ double radius = m_coords[2];
+ if (radius > 0)
+ path.addEllipse(FloatRect(m_coords[0] - radius, m_coords[1] - radius, 2 * radius, 2 * radius));
}
break;
case Rect:
