Diff
Modified: trunk/LayoutTests/ChangeLog (102786 => 102787)
--- trunk/LayoutTests/ChangeLog 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/ChangeLog 2011-12-14 17:13:38 UTC (rev 102787)
@@ -1,3 +1,22 @@
+2011-12-14 Julien Chaffraix <[email protected]>
+
+ Crash in RenderBox::paintBoxDecorations when documentElement has no renderer
+ https://bugs.webkit.org/show_bug.cgi?id=64284
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/dynamic/crash-paint-no-documentElement-renderer-expected.png: Added.
+ * fast/dynamic/crash-paint-no-documentElement-renderer-expected.txt: Added.
+ * fast/dynamic/crash-paint-no-documentElement-renderer.html: Added.
+
+ * platform/chromium/test_expectations.txt:
+ * platform/efl/Skipped:
+ * platform/gtk/test_expectations.txt:
+ * platform/mac/test_expectations.txt:
+ * platform/qt/test_expectations.txt:
+ * platform/win/test_expectations.txt:
+ The test hits the ASSERT from bug 68859 in Debug. However it works well in Release.
+
2011-12-14 Tom Sepez <[email protected]>
DocumentLoader should ref its mainResourceLoader.
Added: trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer-expected.txt (0 => 102787)
--- trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer-expected.txt 2011-12-14 17:13:38 UTC (rev 102787)
@@ -0,0 +1 @@
+*{-webkit-border-before-style:groove}
Added: trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer.html (0 => 102787)
--- trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer.html (rev 0)
+++ trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer.html 2011-12-14 17:13:38 UTC (rev 102787)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body _onload_="go()">
+<p>Bug 64284: Crash in RenderBox::paintBoxDecorations when documentElement has no renderer</p>
+<p>For this test to PASS, it should not ASSERT or CRASH.</p>
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ function go() {
+ document.open();
+ var oUElement = document.createElement("U");
+ oUElement.hidden=true;
+ oUElement.innerHTML="<style>*{-webkit-border-before-style:groove}";
+ document.appendChild(oUElement);
+ document.close();
+ }
+</script>
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/LayoutTests/platform/chromium/test_expectations.txt (102786 => 102787)
--- trunk/LayoutTests/platform/chromium/test_expectations.txt 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/platform/chromium/test_expectations.txt 2011-12-14 17:13:38 UTC (rev 102787)
@@ -3999,3 +3999,6 @@
BUGWK74374 WIN : fast/forms/select-listbox-multiple-no-focusring.html = PASS IMAGE
BUGWK74384 MAC SKIP : fast/forms/select/menulist-onchange-fired-with-key-up-down.html = FAIL
+
+// The test hits an ASSERT in Debug.
+BUGWK68859 DEBUG : fast/dynamic/crash-paint-no-documentElement-renderer.html = CRASH
Modified: trunk/LayoutTests/platform/efl/Skipped (102786 => 102787)
--- trunk/LayoutTests/platform/efl/Skipped 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/platform/efl/Skipped 2011-12-14 17:13:38 UTC (rev 102787)
@@ -1939,3 +1939,7 @@
fast/table/027-vertical.html
tables/mozilla/bugs/bug14929.html
tables/mozilla/bugs/bug2947.html
+
+# The test hits an ASSERT in Debug.
+# https://bugs.webkit.org/show_bug.cgi?id=68859
+fast/dynamic/crash-paint-no-documentElement-renderer.html = CRASH
Modified: trunk/LayoutTests/platform/gtk/test_expectations.txt (102786 => 102787)
--- trunk/LayoutTests/platform/gtk/test_expectations.txt 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/platform/gtk/test_expectations.txt 2011-12-14 17:13:38 UTC (rev 102787)
@@ -6,6 +6,8 @@
BUGWK67007 DEBUG : fast/ruby/after-table-doesnt-crash.html = CRASH
BUGWK67007 DEBUG : fast/ruby/generated-after-counter-doesnt-crash.html = CRASH
BUGWK67007 DEBUG : fast/ruby/generated-before-and-after-counter-doesnt-crash.html = CRASH
+// The test hits an ASSERT in Debug.
+BUGWK68859 DEBUG : fast/dynamic/crash-paint-no-documentElement-renderer.html = CRASH
// Need rebaseline.
BUGWK67408 : fast/forms/input-placeholder-visibility-1.html = FAIL
Modified: trunk/LayoutTests/platform/mac/test_expectations.txt (102786 => 102787)
--- trunk/LayoutTests/platform/mac/test_expectations.txt 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/platform/mac/test_expectations.txt 2011-12-14 17:13:38 UTC (rev 102787)
@@ -39,3 +39,5 @@
BUGWK74270 : fast/forms/basic-selects.html = FAIL
+// The test hits an ASSERT in Debug.
+BUGWK68859 DEBUG : fast/dynamic/crash-paint-no-documentElement-renderer.html = CRASH
Modified: trunk/LayoutTests/platform/qt/test_expectations.txt (102786 => 102787)
--- trunk/LayoutTests/platform/qt/test_expectations.txt 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/platform/qt/test_expectations.txt 2011-12-14 17:13:38 UTC (rev 102787)
@@ -22,3 +22,5 @@
BUGWK74270 : fast/forms/basic-selects.html = FAIL
+// The test hits an ASSERT in Debug.
+BUGWK68859 DEBUG : fast/dynamic/crash-paint-no-documentElement-renderer.html = CRASH
Modified: trunk/LayoutTests/platform/win/test_expectations.txt (102786 => 102787)
--- trunk/LayoutTests/platform/win/test_expectations.txt 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/LayoutTests/platform/win/test_expectations.txt 2011-12-14 17:13:38 UTC (rev 102787)
@@ -17,3 +17,5 @@
BUGWK74270 : fast/forms/basic-selects.html = FAIL
+// The test hits an ASSERT in Debug.
+BUGWK68859 DEBUG : fast/dynamic/crash-paint-no-documentElement-renderer.html = CRASH
Modified: trunk/Source/WebCore/ChangeLog (102786 => 102787)
--- trunk/Source/WebCore/ChangeLog 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/Source/WebCore/ChangeLog 2011-12-14 17:13:38 UTC (rev 102787)
@@ -1,3 +1,16 @@
+2011-12-14 Julien Chaffraix <[email protected]>
+
+ Crash in RenderBox::paintBoxDecorations when documentElement has no renderer
+ https://bugs.webkit.org/show_bug.cgi?id=64284
+
+ Reviewed by Ryosuke Niwa.
+
+ Test: fast/dynamic/crash-paint-no-documentElement-renderer.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::paintBackground): Check the documentElement's
+ renderer before using it which matches what RenderView does.
+
2011-12-14 Tom Sepez <[email protected]>
DocumentLoader should ref its mainResourceLoader.
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (102786 => 102787)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2011-12-14 17:03:07 UTC (rev 102786)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2011-12-14 17:13:38 UTC (rev 102787)
@@ -955,7 +955,7 @@
{
if (isRoot())
paintRootBoxFillLayers(paintInfo);
- else if (!isBody() || document()->documentElement()->renderer()->hasBackground()) {
+ else if (!isBody() || (document()->documentElement()->renderer() && document()->documentElement()->renderer()->hasBackground())) {
// The <body> only paints its background if the root element has defined a background
// independent of the body.
if (!backgroundIsObscured())
