Title: [115127] trunk/Source/WebCore
- Revision
- 115127
- Author
- [email protected]
- Date
- 2012-04-24 15:55:53 -0700 (Tue, 24 Apr 2012)
Log Message
REGRESSION(r115099): html5lib/runner.html crashes.
<http://webkit.org/b/84791>
Reviewed by Anders Carlsson.
Unbreak and simplify the code that filters attributes on isindex elements.
It's perfectly safe to remove elements from a Vector while iterating over it.
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::attributesForIsindexInput):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (115126 => 115127)
--- trunk/Source/WebCore/ChangeLog 2012-04-24 22:55:34 UTC (rev 115126)
+++ trunk/Source/WebCore/ChangeLog 2012-04-24 22:55:53 UTC (rev 115127)
@@ -1,3 +1,16 @@
+2012-04-24 Andreas Kling <[email protected]>
+
+ REGRESSION(r115099): html5lib/runner.html crashes.
+ <http://webkit.org/b/84791>
+
+ Reviewed by Anders Carlsson.
+
+ Unbreak and simplify the code that filters attributes on isindex elements.
+ It's perfectly safe to remove elements from a Vector while iterating over it.
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::attributesForIsindexInput):
+
2012-04-24 Victor Carbune <[email protected]>
Extra display logic for the media control panel element
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (115126 => 115127)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-04-24 22:55:34 UTC (rev 115126)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-04-24 22:55:53 UTC (rev 115127)
@@ -563,17 +563,13 @@
Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
{
Vector<Attribute> attributes = token.attributes();
- Vector<unsigned, 3> indicesToRemove;
for (unsigned i = 0; i < attributes.size(); ++i) {
const QualifiedName& name = attributes.at(i).name();
if (name.matches(nameAttr) || name.matches(actionAttr) || name.matches(promptAttr))
- indicesToRemove.append(i);
+ attributes.remove(i);
}
- for (unsigned i = 0; i < indicesToRemove.size(); ++i)
- attributes.remove(indicesToRemove.at(i));
-
attributes.append(Attribute(nameAttr, isindexTag.localName()));
return attributes;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
