Changeset 117829 in webkit

Timestamp:

May 21, 2012, 4:26:57 PM (14 years ago)

Author:

Lucas Forschler

Message:

Merged r116864.

Location:

branches/safari-536-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt )
• LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html (copied) (copied from trunk/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html )
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLSelectElement.cpp (modified) (2 diffs)

branches/safari-536-branch/LayoutTests/ChangeLog

@@ +1 @@
+2012-05-21  Lucas Forschler  <lforschler@apple.com>
+
+    Merge 116864
+
+    2012-05-12  Abhishek Arya  <inferno@chromium.org>
+
+            Crash in HTMLSelectElement::setOption
+            https://bugs.webkit.org/show_bug.cgi?id=85420
+
+            Reviewed by Eric Seidel.
+
+            * fast/dom/HTMLSelectElement/option-add-crash-expected.txt: Added.
+            * fast/dom/HTMLSelectElement/option-add-crash.html: Added.
+
 2012-05-15  Lucas Forschler  <lforschler@apple.com>
 

branches/safari-536-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-21  Lucas Forschler  <lforschler@apple.com>
+
+    Merge 116864
+
+    2012-05-12  Abhishek Arya  <inferno@chromium.org>
+
+            Crash in HTMLSelectElement::setOption
+            https://bugs.webkit.org/show_bug.cgi?id=85420
+
+            Reviewed by Eric Seidel
+
+            RefPtr before option in HTMLSelectElement::setOption since it
+            can get destroyed due to mutation events.
+
+            Test: fast/dom/HTMLSelectElement/option-add-crash.html
+
+            * html/HTMLSelectElement.cpp:
+            (WebCore::HTMLSelectElement::setOption):
+
 2012-05-16  Lucas Forschler  <lforschler@apple.com>
 

branches/safari-536-branch/Source/WebCore/html/HTMLSelectElement.cpp

@@ -414 +414 @@
         index = maxSelectItems - 1;
     int diff = index - length();
-    HTMLElement* before = 0;
+    RefPtr<HTMLElement> before = 0;
     // Out of array bounds? First insert empty dummies.
     if (diff > 0) {
@@ -425 +425 @@
     // Finally add the new element.
     if (!ec) {
-        add(option, before, ec);
+        add(option, before.get(), ec);
         if (diff >= 0 && option->selected())
             optionSelectionStateChanged(option, true);