Title: [117279] releases/WebKitGTK/webkit-1.8
- Revision
- 117279
- Author
- [email protected]
- Date
- 2012-05-16 06:56:09 -0700 (Wed, 16 May 2012)
Log Message
Merge 113670 - ASSERTION FAILED: !attached() in Node::attach.
https://bugs.webkit.org/show_bug.cgi?id=80726
Reviewed by Adam Barth.
Source/WebCore:
While parsing XML document, prevent attaching the leaf text node
back to document, if its parent is not attached.
Test: fast/dom/text-node-attach-crash.xhtml
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::exitText):
LayoutTests:
* fast/dom/text-node-attach-crash-expected.txt: Added.
* fast/dom/text-node-attach-crash.xhtml: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog (117278 => 117279)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog 2012-05-16 13:55:47 UTC (rev 117278)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog 2012-05-16 13:56:09 UTC (rev 117279)
@@ -1,3 +1,13 @@
+2012-04-09 Abhishek Arya <[email protected]>
+
+ ASSERTION FAILED: !attached() in Node::attach.
+ https://bugs.webkit.org/show_bug.cgi?id=80726
+
+ Reviewed by Adam Barth.
+
+ * fast/dom/text-node-attach-crash-expected.txt: Added.
+ * fast/dom/text-node-attach-crash.xhtml: Added.
+
2012-03-26 Adam Barth <[email protected]>
FrameLoader::shouldAllowNavigation uses Frame for context rather than Document
Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash-expected.txt (0 => 117279)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash-expected.txt 2012-05-16 13:56:09 UTC (rev 117279)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash.xhtml (0 => 117279)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash.xhtml (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash.xhtml 2012-05-16 13:56:09 UTC (rev 117279)
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+Test passes if it does not crash.
+<style></style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var docElement = document.documentElement;
+document.removeChild(docElement);
+window._onload_ = function() {
+ document.appendChild(docElement);
+};
+</script>
+</html>
Property changes on: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/text-node-attach-crash.xhtml
___________________________________________________________________
Added: svn:executable
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog (117278 => 117279)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog 2012-05-16 13:55:47 UTC (rev 117278)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog 2012-05-16 13:56:09 UTC (rev 117279)
@@ -1,3 +1,18 @@
+2012-04-09 Abhishek Arya <[email protected]>
+
+ ASSERTION FAILED: !attached() in Node::attach.
+ https://bugs.webkit.org/show_bug.cgi?id=80726
+
+ Reviewed by Adam Barth.
+
+ While parsing XML document, prevent attaching the leaf text node
+ back to document, if its parent is not attached.
+
+ Test: fast/dom/text-node-attach-crash.xhtml
+
+ * xml/parser/XMLDocumentParser.cpp:
+ (WebCore::XMLDocumentParser::exitText):
+
2012-03-26 Adam Barth <[email protected]>
FrameLoader::shouldAllowNavigation uses Frame for context rather than Document
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/xml/parser/XMLDocumentParser.cpp (117278 => 117279)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/xml/parser/XMLDocumentParser.cpp 2012-05-16 13:55:47 UTC (rev 117278)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/xml/parser/XMLDocumentParser.cpp 2012-05-16 13:56:09 UTC (rev 117279)
@@ -175,7 +175,8 @@
m_bufferedText.swap(empty);
#endif
- if (m_view && !m_leafTextNode->attached())
+ if (m_view && m_leafTextNode->parentNode() && m_leafTextNode->parentNode()->attached()
+ && !m_leafTextNode->attached())
m_leafTextNode->attach();
m_leafTextNode = 0;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
