Title: [131758] trunk
- Revision
- 131758
- Author
- [email protected]
- Date
- 2012-10-18 09:00:26 -0700 (Thu, 18 Oct 2012)
Log Message
REGRESSION(r131464): Null-pointer crash in StyleResolver::styleForElement
https://bugs.webkit.org/show_bug.cgi?id=99587
Patch by Takashi Sakamoto <[email protected]> on 2012-10-18
Reviewed by Dimitri Glazkov.
Source/WebCore:
Since contents in datalist are not shown, summary in datalist is not
shown either. So the summary has no render style. On the other hand,
the summary is implemented by shadow DOM and it has some insertion
point. Its child, e.g. title in the below test, is distributed.
To solve the child's user-modify, looking at shadow host(=summary)'s
style causes null-pointer crash.
Test: fast/dom/shadow/user-modify-in-datalist-crash.html
* css/StyleResolver.cpp:
(WebCore::StyleResolver::styleForElement):
Added a code to check whether the shadow host has any style or not.
LayoutTests:
* fast/dom/shadow/user-modify-in-datalist-crash-expected.txt: Added.
* fast/dom/shadow/user-modify-in-datalist-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (131757 => 131758)
--- trunk/LayoutTests/ChangeLog 2012-10-18 15:55:26 UTC (rev 131757)
+++ trunk/LayoutTests/ChangeLog 2012-10-18 16:00:26 UTC (rev 131758)
@@ -1,3 +1,13 @@
+2012-10-18 Takashi Sakamoto <[email protected]>
+
+ REGRESSION(r131464): Null-pointer crash in StyleResolver::styleForElement
+ https://bugs.webkit.org/show_bug.cgi?id=99587
+
+ Reviewed by Dimitri Glazkov.
+
+ * fast/dom/shadow/user-modify-in-datalist-crash-expected.txt: Added.
+ * fast/dom/shadow/user-modify-in-datalist-crash.html: Added.
+
2012-10-18 Kent Tamura <[email protected]>
[Chromium] Test expectation update mainly for
Added: trunk/LayoutTests/fast/dom/shadow/user-modify-in-datalist-crash-expected.txt (0 => 131758)
--- trunk/LayoutTests/fast/dom/shadow/user-modify-in-datalist-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/user-modify-in-datalist-crash-expected.txt 2012-10-18 16:00:26 UTC (rev 131758)
@@ -0,0 +1,2 @@
+[bug 99587] https://bugs.webkit.org/show_bug.cgi?id=99587 null-pointer crash in StyleResolver::styleForElement. If this test passes, no crash occurs and "PASS" is shown.
+PASS
Added: trunk/LayoutTests/fast/dom/shadow/user-modify-in-datalist-crash.html (0 => 131758)
--- trunk/LayoutTests/fast/dom/shadow/user-modify-in-datalist-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/user-modify-in-datalist-crash.html 2012-10-18 16:00:26 UTC (rev 131758)
@@ -0,0 +1,12 @@
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<div>[bug 99587] <a href=""
+https://bugs.webkit.org/show_bug.cgi?id=99587</a>
+null-pointer crash in StyleResolver::styleForElement.
+If this test passes, no crash occurs and "PASS" is shown.</div>
+<div>PASS</div>
+<datalist>
+<summary>
+<title>
Modified: trunk/Source/WebCore/ChangeLog (131757 => 131758)
--- trunk/Source/WebCore/ChangeLog 2012-10-18 15:55:26 UTC (rev 131757)
+++ trunk/Source/WebCore/ChangeLog 2012-10-18 16:00:26 UTC (rev 131758)
@@ -1,3 +1,23 @@
+2012-10-18 Takashi Sakamoto <[email protected]>
+
+ REGRESSION(r131464): Null-pointer crash in StyleResolver::styleForElement
+ https://bugs.webkit.org/show_bug.cgi?id=99587
+
+ Reviewed by Dimitri Glazkov.
+
+ Since contents in datalist are not shown, summary in datalist is not
+ shown either. So the summary has no render style. On the other hand,
+ the summary is implemented by shadow DOM and it has some insertion
+ point. Its child, e.g. title in the below test, is distributed.
+ To solve the child's user-modify, looking at shadow host(=summary)'s
+ style causes null-pointer crash.
+
+ Test: fast/dom/shadow/user-modify-in-datalist-crash.html
+
+ * css/StyleResolver.cpp:
+ (WebCore::StyleResolver::styleForElement):
+ Added a code to check whether the shadow host has any style or not.
+
2012-10-17 Philippe Normand <[email protected]>
[GTK] AudioBusGtk sometimes fails to load the HRTF database
Modified: trunk/Source/WebCore/css/StyleResolver.cpp (131757 => 131758)
--- trunk/Source/WebCore/css/StyleResolver.cpp 2012-10-18 15:55:26 UTC (rev 131757)
+++ trunk/Source/WebCore/css/StyleResolver.cpp 2012-10-18 16:00:26 UTC (rev 131758)
@@ -1547,8 +1547,8 @@
// be propagated from shadow host to distributed node.
if (m_distributedToInsertionPoint) {
ASSERT(element->parentElement());
- ASSERT(element->parentElement()->renderStyle());
- m_style->setUserModify(element->parentElement()->renderStyle()->userModify());
+ if (RenderStyle* styleOfShadowHost = element->parentElement()->renderStyle())
+ m_style->setUserModify(styleOfShadowHost->userModify());
}
if (element->isLink()) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
