Title: [145665] branches/safari-536.30-branch
- Revision
- 145665
- Author
- [email protected]
- Date
- 2013-03-12 18:43:45 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r142358. <rdar://problem/13334971>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145664 => 145665)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 01:39:56 UTC (rev 145664)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 01:43:45 UTC (rev 145665)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r142358
+
+ 2013-02-09 Kent Tamura <[email protected]>
+
+ Fix crash by img[ismap] with content property
+ https://bugs.webkit.org/show_bug.cgi?id=108702
+
+ Reviewed by Adam Barth.
+
+ * fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt: Added.
+ * fast/dom/HTMLAnchorElement/anchor-ismap-crash.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r141858
2013-02-04 Kent Tamura <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt (from rev 142358, trunk/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt) (0 => 145665)
--- branches/safari-536.30-branch/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt 2013-03-13 01:43:45 UTC (rev 145665)
@@ -0,0 +1,6 @@
+PASS if not crashed.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
+
Copied: branches/safari-536.30-branch/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html (from rev 142358, trunk/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html) (0 => 145665)
--- branches/safari-536.30-branch/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/dom/HTMLAnchorElement/anchor-ismap-crash.html 2013-03-13 01:43:45 UTC (rev 145665)
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<a href="" ismap style="content:'bar'; display:block;"></a>
+<script>
+document.getElementsByTagName('img')[0].click();
+testPassed('if not crashed.');
+</script>
+<script src=""
+</body>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145664 => 145665)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 01:39:56 UTC (rev 145664)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 01:43:45 UTC (rev 145665)
@@ -1,5 +1,22 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r142358
+
+ 2013-02-09 Kent Tamura <[email protected]>
+
+ Fix crash by img[ismap] with content property
+ https://bugs.webkit.org/show_bug.cgi?id=108702
+
+ Reviewed by Adam Barth.
+
+ Test: fast/dom/HTMLAnchorElement/anchor-ismap-crash.html
+
+ * html/HTMLAnchorElement.cpp:
+ (WebCore::appendServerMapMousePosition):
+ Check if the renderer of an img element is RenderImage.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r141858
2013-02-04 Kent Tamura <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/html/HTMLAnchorElement.cpp (145664 => 145665)
--- branches/safari-536.30-branch/Source/WebCore/html/HTMLAnchorElement.cpp 2013-03-13 01:39:56 UTC (rev 145664)
+++ branches/safari-536.30-branch/Source/WebCore/html/HTMLAnchorElement.cpp 2013-03-13 01:43:45 UTC (rev 145665)
@@ -132,9 +132,9 @@
if (!imageElement || !imageElement->isServerMap())
return;
+ if (!imageElement->renderer() || !imageElement->renderer()->isRenderImage())
+ return;
RenderImage* renderer = toRenderImage(imageElement->renderer());
- if (!renderer)
- return;
// FIXME: This should probably pass true for useTransforms.
FloatPoint absolutePosition = renderer->absoluteToLocal(FloatPoint(static_cast<MouseEvent*>(event)->pageX(), static_cast<MouseEvent*>(event)->pageY()));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
