Changeset 175968 in webkit

Timestamp:

Nov 11, 2014, 12:41:50 PM (12 years ago)

Author:

Chris Dumez

Message:

Regression(r175947): Caused assertions in debug builds
​https://bugs.webkit.org/show_bug.cgi?id=138620

Reviewed by Benjamin Poulain.

In HTMLCollection::traverseForward(), traversedCount was incremented 1
time too many when hitting the end of the collection (i.e. element
becomes null). Doing a partial revert.

No new tests, already covered by existing tests.

• html/HTMLCollection.cpp:

(WebCore::HTMLCollection::traverseForward):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLCollection.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-11-11  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r175947): Caused assertions in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=138620
+
+        Reviewed by Benjamin Poulain.
+
+        In HTMLCollection::traverseForward(), traversedCount was incremented 1
+        time too many when hitting the end of the collection (i.e. element
+        becomes null). Doing a partial revert.
+
+        No new tests, already covered by existing tests.
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::traverseForward):
+
 2014-11-11  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/html/HTMLCollection.cpp

@@ -330 +330 @@
     Element* element = &current;
     if (usesCustomForwardOnlyTraversal()) {
-        for (traversedCount = 0; element && traversedCount < count; ++traversedCount)
+        for (traversedCount = 0; traversedCount < count; ++traversedCount) {
             element = customElementAfter(element);
+            if (!element)
+                return nullptr;
+        }
     } else if (m_shouldOnlyIncludeDirectChildren) {
-        for (traversedCount = 0; element && traversedCount < count; ++traversedCount)
+        for (traversedCount = 0; traversedCount < count; ++traversedCount) {
             element = nextMatchingSiblingElement(*this, *element);
+            if (!element)
+                return nullptr;
+        }
     } else {
-        for (traversedCount = 0; element && traversedCount < count; ++traversedCount)
+        for (traversedCount = 0; traversedCount < count; ++traversedCount) {
             element = nextMatchingElement(*this, *element, root);
+            if (!element)
+                return nullptr;
+        }
     }
     return element;