Title: [117829] branches/safari-536-branch
Diff
Modified: branches/safari-536-branch/LayoutTests/ChangeLog (117828 => 117829)
--- branches/safari-536-branch/LayoutTests/ChangeLog 2012-05-21 23:18:39 UTC (rev 117828)
+++ branches/safari-536-branch/LayoutTests/ChangeLog 2012-05-21 23:26:57 UTC (rev 117829)
@@ -1,3 +1,17 @@
+2012-05-21 Lucas Forschler <[email protected]>
+
+ Merge 116864
+
+ 2012-05-12 Abhishek Arya <[email protected]>
+
+ Crash in HTMLSelectElement::setOption
+ https://bugs.webkit.org/show_bug.cgi?id=85420
+
+ Reviewed by Eric Seidel.
+
+ * fast/dom/HTMLSelectElement/option-add-crash-expected.txt: Added.
+ * fast/dom/HTMLSelectElement/option-add-crash.html: Added.
+
2012-05-15 Lucas Forschler <[email protected]>
rollout 116009
Copied: branches/safari-536-branch/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt (from rev 116864, trunk/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt) (0 => 117829)
--- branches/safari-536-branch/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt (rev 0)
+++ branches/safari-536-branch/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt 2012-05-21 23:26:57 UTC (rev 117829)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS. WebKit didn't crash.
Copied: branches/safari-536-branch/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html (from rev 116864, trunk/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html) (0 => 117829)
--- branches/safari-536-branch/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html (rev 0)
+++ branches/safari-536-branch/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html 2012-05-21 23:26:57 UTC (rev 117829)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<script src=""
+<script>
+function crash()
+{
+ try {
+ document.getElementsByTagName('option')[0].parentNode.removeChild(document.getElementsByTagName('option')[0]);
+ } catch (Exception) {}
+
+ gc();
+}
+document.write("PASS. WebKit didn't crash.<select></select>");
+var select1 = document.getElementsByTagName('select')[0];
+select1.appendChild(document.createElement('option'));
+select1.appendChild(document.createElement('option'));
+document.addEventListener("DOMSubtreeModified", crash, false);
+try {
+ select1.options[0] = new Option("", "");
+} catch (Exception) { }
+</script>
+<script src=""
+</html>
Modified: branches/safari-536-branch/Source/WebCore/ChangeLog (117828 => 117829)
--- branches/safari-536-branch/Source/WebCore/ChangeLog 2012-05-21 23:18:39 UTC (rev 117828)
+++ branches/safari-536-branch/Source/WebCore/ChangeLog 2012-05-21 23:26:57 UTC (rev 117829)
@@ -1,3 +1,22 @@
+2012-05-21 Lucas Forschler <[email protected]>
+
+ Merge 116864
+
+ 2012-05-12 Abhishek Arya <[email protected]>
+
+ Crash in HTMLSelectElement::setOption
+ https://bugs.webkit.org/show_bug.cgi?id=85420
+
+ Reviewed by Eric Seidel
+
+ RefPtr before option in HTMLSelectElement::setOption since it
+ can get destroyed due to mutation events.
+
+ Test: fast/dom/HTMLSelectElement/option-add-crash.html
+
+ * html/HTMLSelectElement.cpp:
+ (WebCore::HTMLSelectElement::setOption):
+
2012-05-16 Lucas Forschler <[email protected]>
Merge 116595
Modified: branches/safari-536-branch/Source/WebCore/html/HTMLSelectElement.cpp (117828 => 117829)
--- branches/safari-536-branch/Source/WebCore/html/HTMLSelectElement.cpp 2012-05-21 23:18:39 UTC (rev 117828)
+++ branches/safari-536-branch/Source/WebCore/html/HTMLSelectElement.cpp 2012-05-21 23:26:57 UTC (rev 117829)
@@ -413,7 +413,7 @@
if (index > maxSelectItems - 1)
index = maxSelectItems - 1;
int diff = index - length();
- HTMLElement* before = 0;
+ RefPtr<HTMLElement> before = 0;
// Out of array bounds? First insert empty dummies.
if (diff > 0) {
setLength(index, ec);
@@ -424,7 +424,7 @@
}
// Finally add the new element.
if (!ec) {
- add(option, before, ec);
+ add(option, before.get(), ec);
if (diff >= 0 && option->selected())
optionSelectionStateChanged(option, true);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
