Changeset 70132 in webkit

Timestamp:

Oct 20, 2010 12:44:03 AM (14 years ago)

Author:

hamaji@chromium.org

Message:

2010-10-20 Shinichiro Hamaji <​hamaji@chromium.org>

Reviewed by Kent Tamura.

absolutely positioned list in inline element crashes
​https://bugs.webkit.org/show_bug.cgi?id=45095

• fast/lists/positioned-count-crash-expected.txt: Added.
• fast/lists/positioned-count-crash.html: Added. Note that this test is failing for now.

2010-10-20 Shinichiro Hamaji <​hamaji@chromium.org>

Reviewed by Kent Tamura.

absolutely positioned list in inline element crashes
​https://bugs.webkit.org/show_bug.cgi?id=45095

Add a NULL check to avoid crash. The rendering result isn't ideal yet.

Test: fast/lists/positioned-count-crash.html

• rendering/RenderListItem.cpp: (WebCore::previousListItem):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/lists/positioned-count-crash-expected.txt (added)
• LayoutTests/fast/lists/positioned-count-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/rendering/RenderListItem.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-10-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        absolutely positioned list in inline element crashes
+        https://bugs.webkit.org/show_bug.cgi?id=45095
+
+        * fast/lists/positioned-count-crash-expected.txt: Added.
+        * fast/lists/positioned-count-crash.html: Added. Note that this test is failing for now.
+
 2010-10-19  Yuzo Fujishima  <yuzo@google.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-10-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        absolutely positioned list in inline element crashes
+        https://bugs.webkit.org/show_bug.cgi?id=45095
+
+        Add a NULL check to avoid crash. The rendering result isn't ideal yet.
+
+        Test: fast/lists/positioned-count-crash.html
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+
 2010-10-19  Adam Roben  <aroben@apple.com>
 

trunk/WebCore/rendering/RenderListItem.cpp

@@ -103 +103 @@
 static RenderListItem* previousListItem(Node* list, const RenderListItem* item)
 {
-    for (RenderObject* renderer = item->previousInPreOrder(); renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
+    for (RenderObject* renderer = item->previousInPreOrder(); renderer && renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
         if (!renderer->isListItem())
             continue;