Title: [104082] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104081 => 104082)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:56:13 UTC (rev 104081)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:59:15 UTC (rev 104082)
@@ -1,5 +1,19 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96632
+
+ 2011-09-21 Cris Neckar <[email protected]>
+
+ Add test for crash when performing rich text mutations with counter nodes.
+ https://bugs.webkit.org/show_bug.cgi?id=68563
+
+ Reviewed by Adam Barth.
+
+ * fast/css/counters/counter-after-style-crash-expected.txt: Added.
+ * fast/css/counters/counter-after-style-crash.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96427
2011-09-30 Dan Bernstein <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt (from rev 96632, trunk/LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt) (0 => 104082)
--- branches/safari-534.54-branch/LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt 2012-01-04 22:59:15 UTC (rev 104082)
@@ -0,0 +1 @@
+PASS: Counters updated successfully without crashing
Copied: branches/safari-534.54-branch/LayoutTests/fast/css/counters/counter-after-style-crash.html (from rev 96632, trunk/LayoutTests/fast/css/counters/counter-after-style-crash.html) (0 => 104082)
--- branches/safari-534.54-branch/LayoutTests/fast/css/counters/counter-after-style-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css/counters/counter-after-style-crash.html 2012-01-04 22:59:15 UTC (rev 104082)
@@ -0,0 +1,32 @@
+<html>
+ <script>
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+ </script>
+ <style>
+ div {
+ counter-reset:ctr
+ }
+
+ :after {
+ content:counter(x);
+ counter-increment:ctr;
+ }
+ </style>
+ <junk>TESTING..</div><div><div></div>
+ <span></span>
+ <table>
+ </script>
+ <script>
+ document.designMode='on';
+ document.execCommand('selectall');
+ document.execCommand('italic');
+ document.execCommand('removeformat');
+
+ document.body.innerHTML = "PASS: Counters updated successfully without crashing";
+ layoutTestController.notifyDone();
+ </script>
+ </table>
+</html>
\ No newline at end of file
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104081 => 104082)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:56:13 UTC (rev 104081)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:59:15 UTC (rev 104082)
@@ -1,5 +1,21 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96632
+
+ 2011-09-21 Cris Neckar <[email protected]>
+
+ Hold refptr to identified previous sibling within findPlaceForCounter.
+ https://bugs.webkit.org/show_bug.cgi?id=68563
+
+ Reviewed by Adam Barth.
+
+ Test: fast/css/counters/counter-after-style-crash.html
+
+ * rendering/RenderCounter.cpp:
+ (WebCore::findPlaceForCounter):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96427
2011-09-30 Dan Bernstein <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderCounter.cpp (104081 => 104082)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderCounter.cpp 2012-01-04 22:56:13 UTC (rev 104081)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderCounter.cpp 2012-01-04 22:59:15 UTC (rev 104082)
@@ -299,13 +299,15 @@
// we are trying to find a place for. This is the next renderer to be checked.
RenderObject* currentRenderer = previousInPreOrder(counterOwner);
previousSibling = 0;
+ RefPtr<CounterNode> previousSiblingProtector = 0;
+
while (currentRenderer) {
CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
if (searchEndRenderer == currentRenderer) {
// We may be at the end of our search.
if (currentCounter) {
// We have a suitable counter on the EndSearchRenderer.
- if (previousSibling) { // But we already found another counter that we come after.
+ if (previousSiblingProtector) { // But we already found another counter that we come after.
if (currentCounter->actsAsReset()) {
// We found a reset counter that is on a renderer that is a sibling of ours or a parent.
if (isReset && areRenderersElementsSiblings(currentRenderer, counterOwner)) {
@@ -322,16 +324,19 @@
// In some cases renders can be reparented (ex. nodes inside a table but not in a column or row).
// In these cases the identified previousSibling will be invalid as its parent is different from
// our identified parent.
- if (previousSibling->parent() != currentCounter)
- previousSibling = 0;
+ if (previousSiblingProtector->parent() != currentCounter)
+ previousSiblingProtector = 0;
+
+ previousSibling = previousSiblingProtector.get();
return true;
}
// CurrentCounter, the counter at the EndSearchRenderer, is not reset.
if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
// If the node we are placing is not reset or we have found a counter that is attached
// to an ancestor of the placed counter's owner renderer we know we are a sibling of that node.
- ASSERT(currentCounter->parent() == previousSibling->parent());
+ ASSERT(currentCounter->parent() == previousSiblingProtector->parent());
parent = currentCounter->parent();
+ previousSibling = previousSiblingProtector.get();
return true;
}
} else {
@@ -346,6 +351,7 @@
return parent;
}
parent = currentCounter;
+ previousSibling = previousSiblingProtector.get();
return true;
}
if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
@@ -353,7 +359,7 @@
previousSibling = currentCounter;
return true;
}
- previousSibling = currentCounter;
+ previousSiblingProtector = currentCounter;
}
}
// We come here if the previous sibling or parent of our owner renderer had no
@@ -366,18 +372,18 @@
// counter being placed is attached to.
if (currentCounter) {
// We found a suitable counter.
- if (previousSibling) {
+ if (previousSiblingProtector) {
// Since we had a suitable previous counter before, we should only consider this one as our
// previousSibling if it is a reset counter and hence the current previousSibling is its child.
if (currentCounter->actsAsReset()) {
- previousSibling = currentCounter;
+ previousSiblingProtector = currentCounter;
// We are no longer interested in previous siblings of the currentRenderer or their children
// as counters they may have attached cannot be the previous sibling of the counter we are placing.
currentRenderer = parentElement(currentRenderer)->renderer();
continue;
}
} else
- previousSibling = currentCounter;
+ previousSiblingProtector = currentCounter;
currentRenderer = previousSiblingOrParent(currentRenderer);
continue;
}
@@ -386,7 +392,7 @@
// which may be done twice in some cases. Rearranging the decision points though, to accommodate this
// performance improvement would create more code duplication than is worthwhile in my oppinion and may further
// impede the readability of this already complex algorithm.
- if (previousSibling)
+ if (previousSiblingProtector)
currentRenderer = previousSiblingOrParent(currentRenderer);
else
currentRenderer = previousInPreOrder(currentRenderer);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
