Title: [133693] branches/safari-536.28-branch

Diff

Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133692 => 133693)


--- branches/safari-536.28-branch/LayoutTests/ChangeLog	2012-11-07 00:32:54 UTC (rev 133692)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog	2012-11-07 00:37:45 UTC (rev 133693)
@@ -1,5 +1,19 @@
 2012-11-06  Lucas Forschler  <[email protected]>
 
+        Merge r126657
+
+    2012-08-24  Florin Malita  <[email protected]>
+
+            ASSERTION FAILED: !attached() in WebCore::Node::attach()
+            https://bugs.webkit.org/show_bug.cgi?id=94650
+
+            Reviewed by Abhishek Arya.
+
+            * svg/custom/system-language-crash-expected.txt: Added.
+            * svg/custom/system-language-crash.html: Added.
+
+2012-11-06  Lucas Forschler  <[email protected]>
+
         Merge r126205
 
     2012-08-21  Florin Malita  <[email protected]>
@@ -11122,3 +11136,4 @@
 .
 .
 .
+.

Copied: branches/safari-536.28-branch/LayoutTests/svg/custom/system-language-crash-expected.txt (from rev 126657, trunk/LayoutTests/svg/custom/system-language-crash-expected.txt) (0 => 133693)


--- branches/safari-536.28-branch/LayoutTests/svg/custom/system-language-crash-expected.txt	                        (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/svg/custom/system-language-crash-expected.txt	2012-11-07 00:37:45 UTC (rev 133693)
@@ -0,0 +1,2 @@
+PASS: did not crash.
+

Copied: branches/safari-536.28-branch/LayoutTests/svg/custom/system-language-crash.html (from rev 126657, trunk/LayoutTests/svg/custom/system-language-crash.html) (0 => 133693)


--- branches/safari-536.28-branch/LayoutTests/svg/custom/system-language-crash.html	                        (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/svg/custom/system-language-crash.html	2012-11-07 00:37:45 UTC (rev 133693)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body _onload_="runTest()">
+  <!-- Test for https://bugs.webkit.org/show_bug.cgi?id=94650 -->
+  <div>PASS: did not crash.</div>
+  <svg id="svg" xmlns="http://www.w3.org/2000/svg">
+    <text id="text"></text>
+  </svg>
+
+  <script>
+    if (window.testRunner)
+      testRunner.dumpAsText();
+
+    function runTest() {
+      document.getElementById('svg').systemLanguage.initialize("X");
+      document.getElementById('text').systemLanguage.clear();
+    }
+  </script>
+</body>
+</html>

Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133692 => 133693)


--- branches/safari-536.28-branch/Source/WebCore/ChangeLog	2012-11-07 00:32:54 UTC (rev 133692)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog	2012-11-07 00:37:45 UTC (rev 133693)
@@ -1,5 +1,23 @@
 2012-11-06  Lucas Forschler  <[email protected]>
 
+        Merge r126657
+
+    2012-08-24  Florin Malita  <[email protected]>
+
+            ASSERTION FAILED: !attached() in WebCore::Node::attach()
+            https://bugs.webkit.org/show_bug.cgi?id=94650
+
+            Reviewed by Abhishek Arya.
+
+            Prevent SVGTests::handleAttributeChange() from attaching elements with detached parents.
+
+            Test: svg/custom/system-language-crash.html
+
+            * svg/SVGTests.cpp:
+            (WebCore::SVGTests::handleAttributeChange):
+
+2012-11-06  Lucas Forschler  <[email protected]>
+
         Merge r126205
 
     2012-08-21  Florin Malita  <[email protected]>
@@ -206799,3 +206817,4 @@
 .
 .
 .
+.

Modified: branches/safari-536.28-branch/Source/WebCore/svg/SVGTests.cpp (133692 => 133693)


--- branches/safari-536.28-branch/Source/WebCore/svg/SVGTests.cpp	2012-11-07 00:32:54 UTC (rev 133692)
+++ branches/safari-536.28-branch/Source/WebCore/svg/SVGTests.cpp	2012-11-07 00:37:45 UTC (rev 133693)
@@ -152,11 +152,14 @@
         return false;
     if (!targetElement->inDocument())
         return true;
+
     bool valid = targetElement->isValid();
-    if (valid && !targetElement->attached())
+    bool attached = targetElement->attached();
+    if (valid && !attached && targetElement->parentNode()->attached())
         targetElement->attach();
-    if (!valid && targetElement->attached())
+    else if (!valid && attached)
         targetElement->detach();
+
     return true;
 }
 
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to