Title: [124656] branches/safari-536.26-branch
- Revision
- 124656
- Author
- [email protected]
- Date
- 2012-08-03 14:50:15 -0700 (Fri, 03 Aug 2012)
Log Message
Merged r122188. <rdar://problem/11968363>
Modified Paths
Added Paths
Removed Paths
Diff
Modified: branches/safari-536.26-branch/LayoutTests/ChangeLog (124655 => 124656)
--- branches/safari-536.26-branch/LayoutTests/ChangeLog 2012-08-03 21:41:05 UTC (rev 124655)
+++ branches/safari-536.26-branch/LayoutTests/ChangeLog 2012-08-03 21:50:15 UTC (rev 124656)
@@ -1,5 +1,19 @@
2012-08-02 Lucas Forschler <[email protected]>
+ Merge 122188
+
+ 2012-07-09 Kent Tamura <[email protected]>
+
+ REGRESSION(r114862-r114886): Fix a crash by switching the input type to hidden.
+ https://bugs.webkit.org/show_bug.cgi?id=90774
+
+ Reviewed by Andreas Kling.
+
+ * fast/forms/hidden/change-type-to-hidden-after-updating-value.html: Added.
+ * fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt: Added.
+
+2012-08-02 Lucas Forschler <[email protected]>
+
Merge 121388
2012-06-27 Daniel Cheng <[email protected]>
Deleted: branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt (122188 => 124656)
--- trunk/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt 2012-07-10 03:18:15 UTC (rev 122188)
+++ branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt 2012-08-03 21:50:15 UTC (rev 124656)
@@ -1 +0,0 @@
-PASS unless crashed.
Copied: branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt (from rev 122188, trunk/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt) (0 => 124656)
--- branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value-expected.txt 2012-08-03 21:50:15 UTC (rev 124656)
@@ -0,0 +1 @@
+PASS unless crashed.
Deleted: branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html (122188 => 124656)
--- trunk/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html 2012-07-10 03:18:15 UTC (rev 122188)
+++ branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html 2012-08-03 21:50:15 UTC (rev 124656)
@@ -1,8 +0,0 @@
-<input type="text" id="input1">
-<script>
-if (window.testRunner)
- testRunner.dumpAsText();
-document.getElementById('input1').value = 'value';
-document.getElementById('input1').type = 'hidden';
-document.write('PASS unless crashed.');
-</script>
Copied: branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html (from rev 122188, trunk/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html) (0 => 124656)
--- branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/fast/forms/hidden/change-type-to-hidden-after-updating-value.html 2012-08-03 21:50:15 UTC (rev 124656)
@@ -0,0 +1,8 @@
+<input type="text" id="input1">
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.getElementById('input1').value = 'value';
+document.getElementById('input1').type = 'hidden';
+document.write('PASS unless crashed.');
+</script>
Modified: branches/safari-536.26-branch/Source/WebCore/ChangeLog (124655 => 124656)
--- branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-08-03 21:41:05 UTC (rev 124655)
+++ branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-08-03 21:50:15 UTC (rev 124656)
@@ -1,5 +1,22 @@
2012-08-02 Lucas Forschler <[email protected]>
+ Merge 122188
+
+ 2012-07-09 Kent Tamura <[email protected]>
+
+ REGRESSION(r114862-r114886): Fix a crash by switching the input type to hidden.
+ https://bugs.webkit.org/show_bug.cgi?id=90774
+
+ Reviewed by Andreas Kling.
+
+ Test: fast/forms/hidden/change-type-to-hidden-after-updating-value.html
+
+ * dom/Element.cpp:
+ (WebCore::Element::setAttributeInternal):
+ Pass a copy of the existing Attribute object.
+
+2012-08-02 Lucas Forschler <[email protected]>
+
Merge 121388
2012-06-27 Daniel Cheng <[email protected]>
Modified: branches/safari-536.26-branch/Source/WebCore/dom/Element.cpp (124655 => 124656)
--- branches/safari-536.26-branch/Source/WebCore/dom/Element.cpp 2012-08-03 21:41:05 UTC (rev 124655)
+++ branches/safari-536.26-branch/Source/WebCore/dom/Element.cpp 2012-08-03 21:50:15 UTC (rev 124656)
@@ -692,8 +692,10 @@
else
old->setValue(value);
- if (inUpdateStyleAttribute == NotInUpdateStyleAttribute)
- didModifyAttribute(old);
+ if (inUpdateStyleAttribute == NotInUpdateStyleAttribute) {
+ Attribute dummy(old->name(), old->value());
+ didModifyAttribute(&dummy);
+ }
}
void Element::attributeChanged(Attribute* attr)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
