Copied: branches/chromium/963/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash-expected.txt (from rev 106852, trunk/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash-expected.txt) (0 => 107330)
--- branches/chromium/963/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash-expected.txt 2012-02-10 01:47:07 UTC (rev 107330)
@@ -0,0 +1,2 @@
+PASS: Reparenting nodes outside of table body does not trigger crash.
+
Copied: branches/chromium/963/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash.html (from rev 106852, trunk/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash.html) (0 => 107330)
--- branches/chromium/963/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash.html 2012-02-10 01:47:07 UTC (rev 107330)
@@ -0,0 +1,18 @@
+<html>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<table>
+ <tbody>
+ <td style="counter-increment: list-item"></td>
+ </tbody>
+ <ol><ol>
+ </ol></ol>
+ <td>PASS: Reparenting nodes outside of table body does not trigger crash.</td>
+ <li></li>
+</table>
+<table>
+ <td style="counter-increment: list-item"></td>
+</table>
+</html>
\ No newline at end of file
Modified: branches/chromium/963/Source/WebCore/rendering/RenderCounter.cpp (107329 => 107330)
--- branches/chromium/963/Source/WebCore/rendering/RenderCounter.cpp 2012-02-10 01:45:39 UTC (rev 107329)
+++ branches/chromium/963/Source/WebCore/rendering/RenderCounter.cpp 2012-02-10 01:47:07 UTC (rev 107330)
@@ -301,7 +301,7 @@
// reset node.
// - Non-reset CounterNodes cannot have descendants.
-static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
+static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, RefPtr<CounterNode>& parent, RefPtr<CounterNode>& previousSibling)
{
// We cannot stop searching for counters with the same identifier before we also
// check this renderer, because it may affect the positioning in the tree of our counter.
@@ -346,7 +346,9 @@
if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
// If the node we are placing is not reset or we have found a counter that is attached
// to an ancestor of the placed counter's owner renderer we know we are a sibling of that node.
- ASSERT(currentCounter->parent() == previousSiblingProtector->parent());
+ if (currentCounter->parent() != previousSiblingProtector->parent())
+ return false;
+
parent = currentCounter->parent();
previousSibling = previousSiblingProtector.get();
return true;
@@ -428,11 +430,11 @@
if (!planCounter(object, identifier, isReset, value) && !alwaysCreateCounter)
return 0;
- CounterNode* newParent = 0;
- CounterNode* newPreviousSibling = 0;
+ RefPtr<CounterNode> newParent = 0;
+ RefPtr<CounterNode> newPreviousSibling = 0;
RefPtr<CounterNode> newNode = CounterNode::create(object, isReset, value);
if (findPlaceForCounter(object, identifier, isReset, newParent, newPreviousSibling))
- newParent->insertAfter(newNode.get(), newPreviousSibling, identifier);
+ newParent->insertAfter(newNode.get(), newPreviousSibling.get(), identifier);
CounterMap* nodeMap;
if (object->m_hasCounterNodeMap)
nodeMap = counterMaps().get(object);
@@ -628,8 +630,8 @@
makeCounterNode(renderer, AtomicString(it->first.get()), false);
continue;
}
- CounterNode* newParent = 0;
- CounterNode* newPreviousSibling;
+ RefPtr<CounterNode> newParent = 0;
+ RefPtr<CounterNode> newPreviousSibling = 0;
findPlaceForCounter(renderer, AtomicString(it->first.get()), node->hasResetType(), newParent, newPreviousSibling);
if (node != counterMap->get(it->first.get()))
@@ -640,7 +642,7 @@
if (parent)
parent->removeChild(node.get());
if (newParent)
- newParent->insertAfter(node.get(), newPreviousSibling, it->first.get());
+ newParent->insertAfter(node.get(), newPreviousSibling.get(), it->first.get());
}
}
