Title: [120801] trunk
- Revision
- 120801
- Author
- [email protected]
- Date
- 2012-06-19 22:36:27 -0700 (Tue, 19 Jun 2012)
Log Message
Source/WebCore: Fixes condition where inserting a CounterNode subtree which could result in incorrect placement.
https://bugs.webkit.org/show_bug.cgi?id=88142
Reviewed by Adam Barth.
Test: fast/css/counters/counter-reset-subtree-insert-crash.html
* rendering/CounterNode.cpp:
(WebCore::CounterNode::insertAfter):
LayoutTests: Add test which inserts a CounterNode subtree which contains reset nodes into another tree.
https://bugs.webkit.org/show_bug.cgi?id=88142
Reviewed by Adam Barth.
* fast/css/counters/counter-reset-subtree-insert-crash-expected.txt: Added.
* fast/css/counters/counter-reset-subtree-insert-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (120800 => 120801)
--- trunk/LayoutTests/ChangeLog 2012-06-20 05:34:01 UTC (rev 120800)
+++ trunk/LayoutTests/ChangeLog 2012-06-20 05:36:27 UTC (rev 120801)
@@ -1,3 +1,13 @@
+2012-06-19 Cris Neckar <[email protected]>
+
+ Add test which inserts a CounterNode subtree which contains reset nodes into another tree.
+ https://bugs.webkit.org/show_bug.cgi?id=88142
+
+ Reviewed by Adam Barth.
+
+ * fast/css/counters/counter-reset-subtree-insert-crash-expected.txt: Added.
+ * fast/css/counters/counter-reset-subtree-insert-crash.html: Added.
+
2012-06-19 Csaba Osztrogonác <[email protected]>
Unreviewed expected update after r120735.
Added: trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt (0 => 120801)
--- trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt 2012-06-20 05:36:27 UTC (rev 120801)
@@ -0,0 +1 @@
+PASS: reparenting a counter node subtree that contains resets does not cause a crash.
Added: trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html (0 => 120801)
--- trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html 2012-06-20 05:36:27 UTC (rev 120801)
@@ -0,0 +1,71 @@
+<style>
+#el0::after {
+ content: counter(c);
+ counter-increment: c;
+}
+
+#el1 {
+ content: counter(c);
+ counter-increment: c;
+}
+
+#el2 {
+ content: counter(c);
+ counter-increment: c;
+}
+
+#el2::after {
+ content: counter(c);
+}
+
+#el3 {
+ position: absolute;
+}
+
+#el3::before {
+ content: counter(c);
+ counter-reset: c;
+}
+
+#el3:after {
+ content: counter(c);
+ counter-reset: c;
+}
+
+#el4 {
+ counter-increment: c;
+}
+
+#el5 {
+ content: counter(c);
+ counter-increment: c;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ rules = [
+ "#el2::after { counter-increment: c; } ",
+ "xyz { } "
+ ];
+ stylesheet = document.styleSheets[0];
+ document.body.offsetTop;
+ stylesheet.insertRule(rules[0], stylesheet.length);
+ document.body.offsetTop;
+ stylesheet.insertRule(rules[1], stylesheet.length)
+ document.body.innerHTML = "PASS: reparenting a counter node subtree that contains resets does not cause a crash.";
+}
+</script>
+
+<body>
+ <span id="el0">
+ <div id="el1"></div>
+ <div id="el2">
+ <div id="el3"></div>
+ <span id="el4"></span>
+ </div>
+ <div id="el5"></div>
+ </span>
+</body>
Modified: trunk/Source/WebCore/ChangeLog (120800 => 120801)
--- trunk/Source/WebCore/ChangeLog 2012-06-20 05:34:01 UTC (rev 120800)
+++ trunk/Source/WebCore/ChangeLog 2012-06-20 05:36:27 UTC (rev 120801)
@@ -1,3 +1,15 @@
+2012-06-19 Cris Neckar <[email protected]>
+
+ Fixes condition where inserting a CounterNode subtree which could result in incorrect placement.
+ https://bugs.webkit.org/show_bug.cgi?id=88142
+
+ Reviewed by Adam Barth.
+
+ Test: fast/css/counters/counter-reset-subtree-insert-crash.html
+
+ * rendering/CounterNode.cpp:
+ (WebCore::CounterNode::insertAfter):
+
2012-06-19 Csaba Osztrogonác <[email protected]>
[Qt] Unreviewed buildfix after r120790. Typo fix.
Modified: trunk/Source/WebCore/rendering/CounterNode.cpp (120800 => 120801)
--- trunk/Source/WebCore/rendering/CounterNode.cpp 2012-06-20 05:34:01 UTC (rev 120800)
+++ trunk/Source/WebCore/rendering/CounterNode.cpp 2012-06-20 05:36:27 UTC (rev 120801)
@@ -261,25 +261,22 @@
newChild->m_parent = this;
newChild->m_previousSibling = refChild;
- if (!newChild->m_firstChild || newChild->m_hasResetType) {
+ if (next) {
+ ASSERT(next->m_previousSibling == refChild);
+ next->m_previousSibling = newChild;
newChild->m_nextSibling = next;
- if (next) {
- ASSERT(next->m_previousSibling == refChild);
- next->m_previousSibling = newChild;
- } else {
- ASSERT(m_lastChild == refChild);
- m_lastChild = newChild;
- }
+ } else {
+ ASSERT(m_lastChild == refChild);
+ m_lastChild = newChild;
+ }
+ if (!newChild->m_firstChild || newChild->m_hasResetType) {
newChild->m_countInParent = newChild->computeCountInParent();
newChild->resetThisAndDescendantsRenderers();
if (next)
next->recount();
return;
}
- // If the new child is the last in the sibling list we must set the parent's lastChild.
- if (!newChild->m_nextSibling)
- m_lastChild = newChild;
// The code below handles the case when a formerly root increment counter is loosing its root position
// and therefore its children become next siblings.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
