Title: [113099] trunk
- Revision
- 113099
- Author
- [email protected]
- Date
- 2012-04-03 15:51:44 -0700 (Tue, 03 Apr 2012)
Log Message
Crash in SelectorChecker::checkOneSelector.
https://bugs.webkit.org/show_bug.cgi?id=83040
Reviewed by Antti Koivisto.
Source/WebCore:
Test: fast/css/css-set-selector-text-crash.html
Removing the early bail when we detect that our selector text
hasn't changed, and we don't notify the styleSelectorChanged.
In fact, when we adopt the new selector list, the old one will
get destroyed and the styleSelectorChanged call needs to be made.
* css/CSSStyleRule.cpp:
(WebCore::CSSStyleRule::setSelectorText):
LayoutTests:
* fast/css/css-set-selector-text-crash-expected.txt: Added.
* fast/css/css-set-selector-text-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (113098 => 113099)
--- trunk/LayoutTests/ChangeLog 2012-04-03 22:39:13 UTC (rev 113098)
+++ trunk/LayoutTests/ChangeLog 2012-04-03 22:51:44 UTC (rev 113099)
@@ -1,3 +1,13 @@
+2012-04-03 Abhishek Arya <[email protected]>
+
+ Crash in SelectorChecker::checkOneSelector.
+ https://bugs.webkit.org/show_bug.cgi?id=83040
+
+ Reviewed by Antti Koivisto.
+
+ * fast/css/css-set-selector-text-crash-expected.txt: Added.
+ * fast/css/css-set-selector-text-crash.html: Added.
+
2012-04-03 Tony Chang <[email protected]>
Implement new flex property and deprecate flex function
Added: trunk/LayoutTests/fast/css/css-set-selector-text-crash-expected.txt (0 => 113099)
--- trunk/LayoutTests/fast/css/css-set-selector-text-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/css-set-selector-text-crash-expected.txt 2012-04-03 22:51:44 UTC (rev 113099)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: trunk/LayoutTests/fast/css/css-set-selector-text-crash.html (0 => 113099)
--- trunk/LayoutTests/fast/css/css-set-selector-text-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/css-set-selector-text-crash.html 2012-04-03 22:51:44 UTC (rev 113099)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<style>
+:target { top: 0; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.styleSheets[0].cssRules[0].selectorText = ':target';
+</script>
+Test passes if it does not crash.
+</html>
+
Property changes on: trunk/LayoutTests/fast/css/css-set-selector-text-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (113098 => 113099)
--- trunk/Source/WebCore/ChangeLog 2012-04-03 22:39:13 UTC (rev 113098)
+++ trunk/Source/WebCore/ChangeLog 2012-04-03 22:51:44 UTC (rev 113099)
@@ -1,3 +1,20 @@
+2012-04-03 Abhishek Arya <[email protected]>
+
+ Crash in SelectorChecker::checkOneSelector.
+ https://bugs.webkit.org/show_bug.cgi?id=83040
+
+ Reviewed by Antti Koivisto.
+
+ Test: fast/css/css-set-selector-text-crash.html
+
+ Removing the early bail when we detect that our selector text
+ hasn't changed, and we don't notify the styleSelectorChanged.
+ In fact, when we adopt the new selector list, the old one will
+ get destroyed and the styleSelectorChanged call needs to be made.
+
+ * css/CSSStyleRule.cpp:
+ (WebCore::CSSStyleRule::setSelectorText):
+
2012-04-03 Julien Chaffraix <[email protected]>
presentationAttributeCacheMaximumSize is set too low
Modified: trunk/Source/WebCore/css/CSSStyleRule.cpp (113098 => 113099)
--- trunk/Source/WebCore/css/CSSStyleRule.cpp 2012-04-03 22:39:13 UTC (rev 113098)
+++ trunk/Source/WebCore/css/CSSStyleRule.cpp 2012-04-03 22:51:44 UTC (rev 113099)
@@ -111,9 +111,6 @@
selectorTextCache().set(this, generateSelectorText());
}
- if (this->selectorText() == oldSelectorText)
- return;
-
doc->styleSelectorChanged(DeferRecalcStyle);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
