Changeset 168307 in webkit


Ignore:
Timestamp:
May 5, 2014 11:50:44 AM (10 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r167672 - Check (rather than assume) element is a RenderTableSection before using it
​https://bugs.webkit.org/show_bug.cgi?id=121858

Reviewed by David Kilzer.

Source/WebCore:
Test: fast/table/table-insert-object-before-td-crash.html

  • rendering/RenderTable.cpp:

(WebCore::RenderTable::addChild): Check that lastBox is a table section before
using the node as if it was one.

LayoutTests:

  • fast/table/table-insert-object-before-td-crash-expected.txt: Added.
  • fast/table/table-insert-object-before-td-crash.html: Added.
Location:
releases/WebKitGTK/webkit-2.4
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.4/LayoutTests/ChangeLog

    r168305 r168307  
     12014-04-22  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Check (rather than assume) element is a RenderTableSection before using it
     4        https://bugs.webkit.org/show_bug.cgi?id=121858
     5
     6        Reviewed by David Kilzer.
     7
     8        * fast/table/table-insert-object-before-td-crash-expected.txt: Added.
     9        * fast/table/table-insert-object-before-td-crash.html: Added.
     10
    1112014-04-19  Alexey Proskuryakov  <ap@apple.com>
    212

  • releases/WebKitGTK/webkit-2.4/Source/WebCore/ChangeLog

    r168305 r168307  
     12014-04-22  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Check (rather than assume) element is a RenderTableSection before using it
     4        https://bugs.webkit.org/show_bug.cgi?id=121858
     5
     6        Reviewed by David Kilzer.
     7
     8        Test: fast/table/table-insert-object-before-td-crash.html
     9
     10        * rendering/RenderTable.cpp:
     11        (WebCore::RenderTable::addChild): Check that lastBox is a table section before
     12        using the node as if it was one.
     13
    1142014-04-19  Alexey Proskuryakov  <ap@apple.com>
    215

  • releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RenderTable.cpp

    r162907 r168307  
    202202    while (lastBox && lastBox->parent()->isAnonymous() && !lastBox->isTableSection() && lastBox->style().display() != TABLE_CAPTION && lastBox->style().display() != TABLE_COLUMN_GROUP)
    203203        lastBox = lastBox->parent();
    204     if (lastBox && lastBox->isAnonymous() && !isAfterContent(lastBox)) {
     204    if (lastBox && lastBox->isAnonymous() && !isAfterContent(lastBox) && lastBox->isTableSection()) {
    205205        RenderTableSection* section = toRenderTableSection(lastBox);
    206206        if (beforeChild == section)
Note: See TracChangeset for help on using the changeset viewer.