Title: [116144] branches/chromium/1084
- Revision
- 116144
- Author
- cev...@google.com
- Date
- 2012-05-04 12:38:24 -0700 (Fri, 04 May 2012)
Log Message
Merge 115763
BUG=125494
Review URL: https://chromiumcodereview.appspot.com/10377014
Modified Paths
Diff
Modified: branches/chromium/1084/LayoutTests/html5lib/resources/webkit02.dat (116143 => 116144)
--- branches/chromium/1084/LayoutTests/html5lib/resources/webkit02.dat 2012-05-04 19:35:11 UTC (rev 116143)
+++ branches/chromium/1084/LayoutTests/html5lib/resources/webkit02.dat 2012-05-04 19:38:24 UTC (rev 116144)
@@ -149,3 +149,11 @@
| <input>
| name="isindex"
| <hr>
+
+#data
+<option><XH<optgroup></optgroup>
+#errors
+#document-fragment
+select
+#document
+| <option>
Modified: branches/chromium/1084/Source/WebCore/html/parser/HTMLElementStack.cpp (116143 => 116144)
--- branches/chromium/1084/Source/WebCore/html/parser/HTMLElementStack.cpp 2012-05-04 19:35:11 UTC (rev 116143)
+++ branches/chromium/1084/Source/WebCore/html/parser/HTMLElementStack.cpp 2012-05-04 19:38:24 UTC (rev 116144)
@@ -386,10 +386,12 @@
Element* HTMLElementStack::oneBelowTop() const
{
- // We should never be calling this if it could be 0.
+ // We should never call this if there are fewer than 2 elements on the stack.
ASSERT(m_top);
ASSERT(m_top->next());
- return m_top->next()->element();
+ if (m_top->next()->node()->isElementNode())
+ return m_top->next()->element();
+ return 0;
}
Element* HTMLElementStack::bottom() const
Modified: branches/chromium/1084/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (116143 => 116144)
--- branches/chromium/1084/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-05-04 19:35:11 UTC (rev 116143)
+++ branches/chromium/1084/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-05-04 19:38:24 UTC (rev 116144)
@@ -2204,7 +2204,7 @@
case InSelectMode:
ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode);
if (token.name() == optgroupTag) {
- if (m_tree.currentNode()->hasTagName(optionTag) && m_tree.oneBelowTop()->hasTagName(optgroupTag))
+ if (m_tree.currentNode()->hasTagName(optionTag) && m_tree.oneBelowTop() && m_tree.oneBelowTop()->hasTagName(optgroupTag))
processFakeEndTag(optionTag);
if (m_tree.currentNode()->hasTagName(optgroupTag)) {
m_tree.openElements()->pop();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
