Changeset 30554 in webkit

Timestamp:

Feb 24, 2008, 7:08:37 PM (17 years ago)

Author:

mitz@apple.com

Message:

WebCore:

Reviewed by Darin Adler.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=17471 REGRESSION (r30438): Crash in deleteLineBoxes in cursor-adjusting code browsing Acid3

Test: http/tests/misc/object-image-error.html

• html/HTMLObjectElement.cpp: (WebCore::HTMLObjectElement::attach): Added an early return in case updateFromElement() has changed the object to use fallback content.

LayoutTests:

Reviewed by Darin Adler.

• test for ​http://bugs.webkit.org/show_bug.cgi?id=17471 REGRESSION (r30438): Crash in deleteLineBoxes in cursor-adjusting code browsing Acid3

• http/tests/misc/object-image-error-expected.txt: Added.
• http/tests/misc/object-image-error.html: Added.
• http/tests/misc/resources/404image.php: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/misc/object-image-error-expected.txt (added)
• LayoutTests/http/tests/misc/object-image-error.html (added)
• LayoutTests/http/tests/misc/resources/404image.php (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLObjectElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2008-02-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - test for http://bugs.webkit.org/show_bug.cgi?id=17471
+          REGRESSION (r30438): Crash in deleteLineBoxes in cursor-adjusting code browsing Acid3
+
+        * http/tests/misc/object-image-error-expected.txt: Added.
+        * http/tests/misc/object-image-error.html: Added.
+        * http/tests/misc/resources/404image.php: Added.
+
 2008-02-24  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-02-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17471
+          REGRESSION (r30438): Crash in deleteLineBoxes in cursor-adjusting code browsing Acid3
+
+        Test: http/tests/misc/object-image-error.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::attach): Added an early return in case
+        updateFromElement() has changed the object to use fallback content.
+
 2008-02-24  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/html/HTMLObjectElement.cpp

@@ -172 +172 @@
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
+        // updateForElement() may have changed us to use fallback content and called detach() and attach().
+        if (m_useFallbackContent)
+            return;
+
         if (renderer()) {
             RenderImage* imageObj = static_cast<RenderImage*>(renderer());