Title: [144713] trunk
- Revision
- 144713
- Author
- [email protected]
- Date
- 2013-03-04 20:37:32 -0800 (Mon, 04 Mar 2013)
Log Message
Make sure that clearOwnerNode also clears StyleResolver references (via didMutate).
https://bugs.webkit.org/show_bug.cgi?id=109446
Patch by Tim 'mithro' Ansell <[email protected]> on 2013-03-04
Reviewed by Eric Seidel.
Source/WebCore:
Test: fast/css/stylesheet.innerHTML-calls-didmutate.html
* css/CSSStyleSheet.h:
LayoutTests:
* fast/css/stylesheet.innerHTML-calls-didmutate-expected.txt: Added.
* fast/css/stylesheet.innerHTML-calls-didmutate.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (144712 => 144713)
--- trunk/LayoutTests/ChangeLog 2013-03-05 03:49:29 UTC (rev 144712)
+++ trunk/LayoutTests/ChangeLog 2013-03-05 04:37:32 UTC (rev 144713)
@@ -1,3 +1,13 @@
+2013-03-04 Tim 'mithro' Ansell <[email protected]>
+
+ Make sure that clearOwnerNode also clears StyleResolver references (via didMutate).
+ https://bugs.webkit.org/show_bug.cgi?id=109446
+
+ Reviewed by Eric Seidel.
+
+ * fast/css/stylesheet.innerHTML-calls-didmutate-expected.txt: Added.
+ * fast/css/stylesheet.innerHTML-calls-didmutate.html: Added.
+
2013-03-04 Christian Biesinger <[email protected]>
REGRESSION (r143643): Buttons containing floats render differently
Added: trunk/LayoutTests/fast/css/stylesheet.innerHTML-calls-didmutate-expected.txt (0 => 144713)
--- trunk/LayoutTests/fast/css/stylesheet.innerHTML-calls-didmutate-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/stylesheet.innerHTML-calls-didmutate-expected.txt 2013-03-05 04:37:32 UTC (rev 144713)
@@ -0,0 +1 @@
+Changing a documents stylesheet's innerHTML should not crash.
Added: trunk/LayoutTests/fast/css/stylesheet.innerHTML-calls-didmutate.html (0 => 144713)
--- trunk/LayoutTests/fast/css/stylesheet.innerHTML-calls-didmutate.html (rev 0)
+++ trunk/LayoutTests/fast/css/stylesheet.innerHTML-calls-didmutate.html 2013-03-05 04:37:32 UTC (rev 144713)
@@ -0,0 +1,23 @@
+<style>
+ h6 {
+ text-shadow: 0.85714in -110pc -0.216688mm;
+ }
+ p + h6 {
+ left: 180cm;
+ }
+</style>
+<script>
+function main() {
+ var styletag = document.getElementsByTagName("style")[0];
+ styletag.type = "p";
+ styletag.innerHTML = "t";
+ var second_h6 = document.getElementsByTagName("h6")[1];
+ second_h6.align = 'a';
+ document.styleSheets[0].removeRule(0);
+
+ if (window.testRunner)
+ testRunner.dumpAsText();
+}
+</script>
+<body _onload_=main()><h6><h6>
+Changing a documents stylesheet's innerHTML should not crash.
Modified: trunk/Source/WebCore/ChangeLog (144712 => 144713)
--- trunk/Source/WebCore/ChangeLog 2013-03-05 03:49:29 UTC (rev 144712)
+++ trunk/Source/WebCore/ChangeLog 2013-03-05 04:37:32 UTC (rev 144713)
@@ -1,3 +1,14 @@
+2013-03-04 Tim 'mithro' Ansell <[email protected]>
+
+ Make sure that clearOwnerNode also clears StyleResolver references (via didMutate).
+ https://bugs.webkit.org/show_bug.cgi?id=109446
+
+ Reviewed by Eric Seidel.
+
+ Test: fast/css/stylesheet.innerHTML-calls-didmutate.html
+
+ * css/CSSStyleSheet.h:
+
2013-03-04 Kentaro Hara <[email protected]>
Unreviewd build fix after r144701.
Modified: trunk/Source/WebCore/css/CSSStyleSheet.h (144712 => 144713)
--- trunk/Source/WebCore/css/CSSStyleSheet.h 2013-03-05 03:49:29 UTC (rev 144712)
+++ trunk/Source/WebCore/css/CSSStyleSheet.h 2013-03-05 04:37:32 UTC (rev 144713)
@@ -74,7 +74,7 @@
unsigned length() const;
CSSRule* item(unsigned index);
- virtual void clearOwnerNode() OVERRIDE { m_ownerNode = 0; }
+ virtual void clearOwnerNode() OVERRIDE { didMutate(); m_ownerNode = 0; }
virtual CSSImportRule* ownerRule() const OVERRIDE { return m_ownerRule; }
virtual KURL baseURL() const OVERRIDE;
virtual bool isLoading() const OVERRIDE;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
