Changeset 80803 in webkit

Timestamp:

Mar 10, 2011 6:17:14 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-03-10 Alice Boxhall <​aboxhall@chromium.org>

Reviewed by Dimitri Glazkov.

NULL pointer crash when using :empty and :first-line pseudoclass selectors together
​https://bugs.webkit.org/show_bug.cgi?id=53316

• fast/css/empty-first-line-crash-expected.txt: Added.
• fast/css/empty-first-line-crash.html: Added.

2011-03-10 Alice Boxhall <​aboxhall@chromium.org>

Reviewed by Dimitri Glazkov.

NULL pointer crash when using :empty and :first-line pseudoclass selectors together
​https://bugs.webkit.org/show_bug.cgi?id=53316

:empty is calculated for each element during parsing, but then not
recalculated after any child elements are attached. Force style
re-calculation on elements which have :empty in their style when
their children are changed.

Test: fast/css/empty-first-line-crash.html

• dom/Element.cpp: (WebCore::checkForEmptyStyleChange): Pull out empty style checking logic from checkForSiblingStyleChanges(). (WebCore::checkForSiblingStyleChanges): Use new checkForEmptyStyleChanges() method. (WebCore::Element::childrenChanged): Call checkForEmptyStyleChanges() when called with changedByParser = true.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/empty-first-line-crash-expected.txt (added)
• LayoutTests/fast/css/empty-first-line-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Element.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-03-10  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        NULL pointer crash when using :empty and :first-line pseudoclass selectors together
+        https://bugs.webkit.org/show_bug.cgi?id=53316
+
+        * fast/css/empty-first-line-crash-expected.txt: Added.
+        * fast/css/empty-first-line-crash.html: Added.
+
 2011-03-10  Martin Robinson  <mrobinson@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-03-10  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        NULL pointer crash when using :empty and :first-line pseudoclass selectors together
+        https://bugs.webkit.org/show_bug.cgi?id=53316
+
+        :empty is calculated for each element during parsing, but then not 
+        recalculated after any child elements are attached. Force style 
+        re-calculation on elements which have :empty in their style when
+        their children are changed.
+
+        Test: fast/css/empty-first-line-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::checkForEmptyStyleChange): Pull out empty style checking
+        logic from checkForSiblingStyleChanges().
+        (WebCore::checkForSiblingStyleChanges): Use new checkForEmptyStyleChanges()
+        method.
+        (WebCore::Element::childrenChanged):  Call checkForEmptyStyleChanges() when
+        called with changedByParser = true.
+
 2011-03-10  Emil A Eklund  <eae@chromium.org>
 

trunk/Source/WebCore/dom/Element.cpp

@@ -1184 +1184 @@
 }
 
+static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
+{
+    if (!style)
+        return;
+
+    if (style->affectedByEmpty() && (!style->emptyState() || element->hasChildNodes()))
+        element->setNeedsStyleRecalc();
+}
+
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -1260 +1269 @@
     
     // :empty selector.
-    if (style->affectedByEmpty() && (!style->emptyState() || e->hasChildNodes()))
-        e->setNeedsStyleRecalc();
+    checkForEmptyStyleChange(e, style);
 }
 
@@ -1267 +1275 @@
 {
     ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (!changedByParser)
+    if (changedByParser)
+        checkForEmptyStyleChange(this, renderStyle());
+    else
         checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
 }
-    
+
 void Element::beginParsingChildren()
 {