Changeset 59950 in webkit
- Timestamp:
- May 21, 2010, 12:53:29 PM (14 years ago)
- Location:
- trunk
- Files:
-
- 4 added
- 3 edited
-
LayoutTests/ChangeLog (modified) (1 diff)
-
LayoutTests/fast/lists/alpha-boundary-values.html (added)
-
LayoutTests/platform/mac/fast/lists/alpha-boundary-values-expected.checksum (added)
-
LayoutTests/platform/mac/fast/lists/alpha-boundary-values-expected.png (added)
-
LayoutTests/platform/mac/fast/lists/alpha-boundary-values-expected.txt (added)
-
WebCore/ChangeLog (modified) (1 diff)
-
WebCore/rendering/RenderListMarker.cpp (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r59941 r59950 1 2010-05-21 Beth Dakin <bdakin@apple.com> 2 3 Reviewed by Darin Adler. 4 5 Test for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 6 while running MangleMe 7 -and corresponding- 8 https://bugs.webkit.org/show_bug.cgi?id=39508 9 10 * fast/lists/alpha-boundary-values.html: Added. 11 * platform/mac/fast/lists/alpha-boundary-values-expected.checksum: Added. 12 * platform/mac/fast/lists/alpha-boundary-values-expected.png: Added. 13 * platform/mac/fast/lists/alpha-boundary-values-expected.txt: Added. 14 1 15 2010-05-21 Oliver Hunt <oliver@apple.com> 2 16 -
trunk/WebCore/ChangeLog
r59949 r59950 1 2010-05-21 Beth Dakin <bdakin@apple.com> 2 3 Reviewed by Darin Adler. 4 5 Fix for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 6 while running MangleMe 7 -and corresponding- 8 https://bugs.webkit.org/show_bug.cgi?id=39508 9 10 The math was slightly off here, and we wound up trying to access an 11 array at index -1 in some cases. We need to decrement numberShadow 12 rather than subtracting one from the result of the modulo 13 operation. 14 15 * rendering/RenderListMarker.cpp: 16 (WebCore::toAlphabeticOrNumeric): 17 1 18 2010-05-21 Oliver Hunt <oliver@apple.com> 2 19 -
trunk/WebCore/rendering/RenderListMarker.cpp
r54472 r59950 102 102 103 103 if (type == AlphabeticSequence) { 104 while ((numberShadow /= sequenceSize) > 0) 105 letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize - 1]; 104 while ((numberShadow /= sequenceSize) > 0) { 105 --numberShadow; 106 letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize]; 107 } 106 108 } else { 107 109 while ((numberShadow /= sequenceSize) > 0)
Note:
See TracChangeset
for help on using the changeset viewer.