Title: [113670] trunk
- Revision
- 113670
- Author
- [email protected]
- Date
- 2012-04-09 20:41:56 -0700 (Mon, 09 Apr 2012)
Log Message
ASSERTION FAILED: !attached() in Node::attach.
https://bugs.webkit.org/show_bug.cgi?id=80726
Reviewed by Adam Barth.
Source/WebCore:
While parsing XML document, prevent attaching the leaf text node
back to document, if its parent is not attached.
Test: fast/dom/text-node-attach-crash.xhtml
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::exitText):
LayoutTests:
* fast/dom/text-node-attach-crash-expected.txt: Added.
* fast/dom/text-node-attach-crash.xhtml: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (113669 => 113670)
--- trunk/LayoutTests/ChangeLog 2012-04-10 03:39:20 UTC (rev 113669)
+++ trunk/LayoutTests/ChangeLog 2012-04-10 03:41:56 UTC (rev 113670)
@@ -1,3 +1,13 @@
+2012-04-09 Abhishek Arya <[email protected]>
+
+ ASSERTION FAILED: !attached() in Node::attach.
+ https://bugs.webkit.org/show_bug.cgi?id=80726
+
+ Reviewed by Adam Barth.
+
+ * fast/dom/text-node-attach-crash-expected.txt: Added.
+ * fast/dom/text-node-attach-crash.xhtml: Added.
+
2012-04-09 James Simonsen <[email protected]>
[Chromium] Unreviewed gardening.
Added: trunk/LayoutTests/fast/dom/text-node-attach-crash-expected.txt (0 => 113670)
--- trunk/LayoutTests/fast/dom/text-node-attach-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/text-node-attach-crash-expected.txt 2012-04-10 03:41:56 UTC (rev 113670)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: trunk/LayoutTests/fast/dom/text-node-attach-crash.xhtml (0 => 113670)
--- trunk/LayoutTests/fast/dom/text-node-attach-crash.xhtml (rev 0)
+++ trunk/LayoutTests/fast/dom/text-node-attach-crash.xhtml 2012-04-10 03:41:56 UTC (rev 113670)
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+Test passes if it does not crash.
+<style></style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var docElement = document.documentElement;
+document.removeChild(docElement);
+window._onload_ = function() {
+ document.appendChild(docElement);
+};
+</script>
+</html>
Property changes on: trunk/LayoutTests/fast/dom/text-node-attach-crash.xhtml
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (113669 => 113670)
--- trunk/Source/WebCore/ChangeLog 2012-04-10 03:39:20 UTC (rev 113669)
+++ trunk/Source/WebCore/ChangeLog 2012-04-10 03:41:56 UTC (rev 113670)
@@ -1,3 +1,18 @@
+2012-04-09 Abhishek Arya <[email protected]>
+
+ ASSERTION FAILED: !attached() in Node::attach.
+ https://bugs.webkit.org/show_bug.cgi?id=80726
+
+ Reviewed by Adam Barth.
+
+ While parsing XML document, prevent attaching the leaf text node
+ back to document, if its parent is not attached.
+
+ Test: fast/dom/text-node-attach-crash.xhtml
+
+ * xml/parser/XMLDocumentParser.cpp:
+ (WebCore::XMLDocumentParser::exitText):
+
2012-04-09 Dana Jansens <[email protected]>
[chromium] Replica layers are not drawn, so should not be painted
Modified: trunk/Source/WebCore/xml/parser/XMLDocumentParser.cpp (113669 => 113670)
--- trunk/Source/WebCore/xml/parser/XMLDocumentParser.cpp 2012-04-10 03:39:20 UTC (rev 113669)
+++ trunk/Source/WebCore/xml/parser/XMLDocumentParser.cpp 2012-04-10 03:41:56 UTC (rev 113670)
@@ -175,7 +175,8 @@
m_bufferedText.swap(empty);
#endif
- if (m_view && !m_leafTextNode->attached())
+ if (m_view && m_leafTextNode->parentNode() && m_leafTextNode->parentNode()->attached()
+ && !m_leafTextNode->attached())
m_leafTextNode->attach();
m_leafTextNode = 0;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
