Title: [195207] releases/WebKitGTK/webkit-2.10
- Revision
- 195207
- Author
- [email protected]
- Date
- 2016-01-18 04:18:35 -0800 (Mon, 18 Jan 2016)
Log Message
Merge r194617 - Image should not be re-registered if m_form already exists. This leads to an assertion failure.
https://bugs.webkit.org/show_bug.cgi?id=152741
<rdar://problem/24030778>
Patch by Pranjal Jumde <[email protected]> on 2016-01-05
Reviewed by Brent Fulgham.
Source/WebCore:
* Source/WebCore/html/HTMLImageElement.cpp:
Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode& insertionPoint)
LayoutTests:
* LayoutTests/fast/html/form-registerimg-multiple-crash-expected.txt: Added.
* LayoutTests/fast/html/form-registerimg-multiple-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195206 => 195207)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-18 12:16:16 UTC (rev 195206)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-18 12:18:35 UTC (rev 195207)
@@ -1,3 +1,14 @@
+2016-01-05 Pranjal Jumde <[email protected]>
+
+ Image should not be re-registered if m_form already exists. This leads to an assertion failure.
+ https://bugs.webkit.org/show_bug.cgi?id=152741
+ <rdar://problem/24030778>
+
+ Reviewed by Brent Fulgham.
+
+ * LayoutTests/fast/html/form-registerimg-multiple-crash-expected.txt: Added.
+ * LayoutTests/fast/html/form-registerimg-multiple-crash.html: Added.
+
2015-12-31 Zalan Bujtas <[email protected]>
Simple line layout: Text with stroke width is not positioned correctly.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/fast/html/form-registerimg-multiple-crash-expected.txt (0 => 195207)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/fast/html/form-registerimg-multiple-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/fast/html/form-registerimg-multiple-crash-expected.txt 2016-01-18 12:18:35 UTC (rev 195207)
@@ -0,0 +1,3 @@
+
+
+Test passes if no crash on ASSERT.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/fast/html/form-registerimg-multiple-crash.html (0 => 195207)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/fast/html/form-registerimg-multiple-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/fast/html/form-registerimg-multiple-crash.html 2016-01-18 12:18:35 UTC (rev 195207)
@@ -0,0 +1,12 @@
+<form id="w">
+ <img src=""
+</form>
+Test passes if no crash on ASSERT.
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var form = document.getElementById("w");
+clone = form.cloneNode(true);
+form.appendChild(clone);
+</script>
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195206 => 195207)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-18 12:16:16 UTC (rev 195206)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-18 12:18:35 UTC (rev 195207)
@@ -1,3 +1,14 @@
+2016-01-05 Pranjal Jumde <[email protected]>
+
+ Image should not be re-registered if m_form already exists. This leads to an assertion failure.
+ https://bugs.webkit.org/show_bug.cgi?id=152741
+ <rdar://problem/24030778>
+
+ Reviewed by Brent Fulgham.
+
+ * Source/WebCore/html/HTMLImageElement.cpp:
+ Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode& insertionPoint)
+
2016-01-05 Eric Carlson <[email protected]>
Avoid NULL deference in Page::updateIsPlayingMedia
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp (195206 => 195207)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp 2016-01-18 12:16:16 UTC (rev 195206)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp 2016-01-18 12:18:35 UTC (rev 195207)
@@ -245,14 +245,14 @@
if (m_formSetByParser) {
m_form = m_formSetByParser;
m_formSetByParser = nullptr;
+ m_form->registerImgElement(this);
}
- if (!m_form)
+ if (!m_form) {
m_form = HTMLFormElement::findClosestFormAncestor(*this);
-
- if (m_form)
- m_form->registerImgElement(this);
-
+ if (m_form)
+ m_form->registerImgElement(this);
+ }
// Insert needs to complete first, before we start updating the loader. Loader dispatches events which could result
// in callbacks back to this node.
Node::InsertionNotificationRequest insertNotificationRequest = HTMLElement::insertedInto(insertionPoint);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
