Title: [125343] trunk
- Revision
- 125343
- Author
- [email protected]
- Date
- 2012-08-10 18:49:14 -0700 (Fri, 10 Aug 2012)
Log Message
RenderQuote corrupts doubly linked list on insertion before head of list
https://bugs.webkit.org/show_bug.cgi?id=93750
Patch by Elliott Sprehn <[email protected]> on 2012-08-10
Reviewed by Abhishek Arya.
Source/WebCore:
Fix bug where moving a RenderQuote instance before the first one in
the document would not update the m_previous pointer of the original
first RenderQuote to point back at the new one.
Test: fast/css-generated-content/quote-crash-93750.html
* rendering/RenderQuote.cpp:
(WebCore::RenderQuote::attachQuote):
LayoutTests:
Test for moving around RenderQuote nodes before each other in an
existing document to catch corruption in the linked list of RenderQuote.
* fast/css-generated-content/quote-crash-93750-expected.txt: Added.
* fast/css-generated-content/quote-crash-93750.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125342 => 125343)
--- trunk/LayoutTests/ChangeLog 2012-08-11 01:45:46 UTC (rev 125342)
+++ trunk/LayoutTests/ChangeLog 2012-08-11 01:49:14 UTC (rev 125343)
@@ -1,3 +1,16 @@
+2012-08-10 Elliott Sprehn <[email protected]>
+
+ RenderQuote corrupts doubly linked list on insertion before head of list
+ https://bugs.webkit.org/show_bug.cgi?id=93750
+
+ Reviewed by Abhishek Arya.
+
+ Test for moving around RenderQuote nodes before each other in an
+ existing document to catch corruption in the linked list of RenderQuote.
+
+ * fast/css-generated-content/quote-crash-93750-expected.txt: Added.
+ * fast/css-generated-content/quote-crash-93750.html: Added.
+
2012-08-10 Dean Jackson <[email protected]>
REGRESSION (r124416): fast/forms/basic-selects.html failing on Lion Debug Tests
Added: trunk/LayoutTests/fast/css-generated-content/quote-crash-93750-expected.txt (0 => 125343)
--- trunk/LayoutTests/fast/css-generated-content/quote-crash-93750-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/quote-crash-93750-expected.txt 2012-08-11 01:49:14 UTC (rev 125343)
@@ -0,0 +1,5 @@
+Bug 93750: RenderQuote corrupts doubly linked list on insertion before head of list
+
+It passes if it does not CRASH or ASSERT.
+
+
Added: trunk/LayoutTests/fast/css-generated-content/quote-crash-93750.html (0 => 125343)
--- trunk/LayoutTests/fast/css-generated-content/quote-crash-93750.html (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/quote-crash-93750.html 2012-08-11 01:49:14 UTC (rev 125343)
@@ -0,0 +1,21 @@
+<!doctype html>
+
+<style>
+ .fixed::before {
+ position:fixed;
+ }
+</style>
+
+<script>
+ if (window.testRunner) window.testRunner.dumpAsText();
+ _onload_ = function(){
+ document.designMode = "on";
+ document.execCommand("SelectAll");
+ document.execCommand("Indent", false);
+ }
+</script>
+
+<p>Bug <a href="" RenderQuote corrupts doubly linked list on insertion before head of list</p>
+<p>It passes if it does not CRASH or ASSERT.</p>
+
+<q class="fixed"></q>
Modified: trunk/Source/WebCore/ChangeLog (125342 => 125343)
--- trunk/Source/WebCore/ChangeLog 2012-08-11 01:45:46 UTC (rev 125342)
+++ trunk/Source/WebCore/ChangeLog 2012-08-11 01:49:14 UTC (rev 125343)
@@ -1,3 +1,19 @@
+2012-08-10 Elliott Sprehn <[email protected]>
+
+ RenderQuote corrupts doubly linked list on insertion before head of list
+ https://bugs.webkit.org/show_bug.cgi?id=93750
+
+ Reviewed by Abhishek Arya.
+
+ Fix bug where moving a RenderQuote instance before the first one in
+ the document would not update the m_previous pointer of the original
+ first RenderQuote to point back at the new one.
+
+ Test: fast/css-generated-content/quote-crash-93750.html
+
+ * rendering/RenderQuote.cpp:
+ (WebCore::RenderQuote::attachQuote):
+
2012-08-09 James Robinson <[email protected]>
[chromium] Remove forwarding headers for compositor-related WebKit API and update includes
Modified: trunk/Source/WebCore/rendering/RenderQuote.cpp (125342 => 125343)
--- trunk/Source/WebCore/rendering/RenderQuote.cpp 2012-08-11 01:45:46 UTC (rev 125342)
+++ trunk/Source/WebCore/rendering/RenderQuote.cpp 2012-08-11 01:49:14 UTC (rev 125343)
@@ -143,6 +143,8 @@
if (!m_previous) {
m_next = view()->renderQuoteHead();
view()->setRenderQuoteHead(this);
+ if (m_next)
+ m_next->m_previous = this;
}
m_attached = true;
@@ -150,7 +152,9 @@
quote->updateDepth();
ASSERT(!m_next || m_next->m_attached);
+ ASSERT(!m_next || m_next->m_previous == this);
ASSERT(!m_previous || m_previous->m_attached);
+ ASSERT(!m_previous || m_previous->m_next == this);
}
void RenderQuote::detachQuote()
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
