Changeset 13955 in webkit

Timestamp:

Apr 18, 2006 9:37:40 AM (18 years ago)

Author:

darin

Message:

Reviewed by Darin.

• fix ​http://bugzilla.opendarwin.org/show_bug.cgi?id=8437 iExploder(#293): Crash in StringImpl::hash()

• manual-tests/applet-param-no-name.html: Added.
• rendering/RenderApplet.cpp: (WebCore::RenderApplet::createWidgetIfNecessary): Skip param elements with empty name.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• manual-tests/applet-param-no-name.html (added)
• rendering/RenderApplet.cpp (modified) (1 diff)
• rendering/render_form.cpp (modified) (2 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2006-04-18  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Darin.
+
+        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8437
+          iExploder(#293): Crash in StringImpl::hash()
+
+        * manual-tests/applet-param-no-name.html: Added.
+        * rendering/RenderApplet.cpp:
+        (WebCore::RenderApplet::createWidgetIfNecessary): Skip param elements with
+        empty name.
+
 2006-04-18  Darin Adler  <darin@apple.com>
 

trunk/WebCore/rendering/RenderApplet.cpp

@@ -77 +77 @@
         if (child->hasTagName(paramTag)) {
             HTMLParamElement* p = static_cast<HTMLParamElement*>(child);
-            m_args.set(p->name(), p->value());
+            if (!p->name().isEmpty())
+                m_args.set(p->name(), p->value());
         }
     setWidget(new JavaAppletWidget(IntSize(width, height), node()->document()->frame(), m_args));

trunk/WebCore/rendering/render_form.cpp

@@ -668 +668 @@
             else if (listItems[listIndex]->hasTagName(optionTag)) {
                 HTMLOptionElement *optionElement = static_cast<HTMLOptionElement*>(listItems[listIndex]);
-                DeprecatedString itemText;
-                if (optionElement->hasAttribute(labelAttr))
+                DeprecatedString itemText = optionElement->text().deprecatedString();
+                if (itemText.isEmpty())
                     itemText = optionElement->getAttribute(labelAttr).deprecatedString();
-                else
-                    itemText = optionElement->text().deprecatedString();
                 
                 itemText.replace(QChar('\\'), backslashAsCurrencySymbol());
@@ -678 +676 @@
                 // In WinIE, leading and trailing whitespace is ignored in options. We match this behavior.
                 itemText = itemText.stripWhiteSpace();
-                // We want to collapse our whitespace too.  This will match other browsers.
+                // We want to collapse our whitespace too. This will match other browsers.
                 itemText = itemText.simplifyWhiteSpace();