Title: [123528] branches/chromium/1180
- Revision
- 123528
- Author
- [email protected]
- Date
- 2012-07-24 14:35:34 -0700 (Tue, 24 Jul 2012)
Log Message
Merge 123128 - Crash in WebCore::StyleResolver::collectMatchingRulesForList
https://bugs.webkit.org/show_bug.cgi?id=90803
BUG=136235
Review URL: https://chromiumcodereview.appspot.com/10809085
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1180/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt (from rev 123128, trunk/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt) (0 => 123528)
--- branches/chromium/1180/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt (rev 0)
+++ branches/chromium/1180/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt 2012-07-24 21:35:34 UTC (rev 123528)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/1180/LayoutTests/fast/css/xml-stylesheet-removed.xhtml (from rev 123128, trunk/LayoutTests/fast/css/xml-stylesheet-removed.xhtml) (0 => 123528)
--- branches/chromium/1180/LayoutTests/fast/css/xml-stylesheet-removed.xhtml (rev 0)
+++ branches/chromium/1180/LayoutTests/fast/css/xml-stylesheet-removed.xhtml 2012-07-24 21:35:34 UTC (rev 123528)
@@ -0,0 +1,18 @@
+<?xml-stylesheet href="" title="style" type="text/css"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<div id="result">FAIL</div>
+<script type="text/_javascript_">
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+_onload_ = function() {
+ document.documentElement.appendChild(document.styleSheets[0].ownerNode);
+ // Note: xml stylesheet is only valid when its parent is the document
+ if (document.styleSheets.length == 0)
+ document.getElementById('result').innerText = 'PASS';
+ if (window.testRunner)
+ testRunner.notifyDone();
+};
+</script>
+</html>
Modified: branches/chromium/1180/Source/WebCore/dom/ProcessingInstruction.cpp (123527 => 123528)
--- branches/chromium/1180/Source/WebCore/dom/ProcessingInstruction.cpp 2012-07-24 21:26:37 UTC (rev 123527)
+++ branches/chromium/1180/Source/WebCore/dom/ProcessingInstruction.cpp 2012-07-24 21:35:34 UTC (rev 123528)
@@ -312,7 +312,8 @@
m_sheet = 0;
}
- if (m_cachedSheet)
+ // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
+ if (document()->renderer())
document()->styleResolverChanged(DeferRecalcStyle);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
