Changeset 88104 in webkit


Ignore:
Timestamp:
Jun 4, 2011 3:32:26 AM (13 years ago)
Author:
commit-queue@webkit.org
Message:

2011-06-04 Jeffrey Pfau <​jpfau@apple.com>

Reviewed by Beth Dakin.

Crash in WebCore::RenderMathMLSubSup::baselinePosition()
​https://bugs.webkit.org/show_bug.cgi?id=57897

Added simple test that hits the relevant code.

  • mathml/msubsup-remove-children-expected.txt: Added.
  • mathml/msubsup-remove-children.xhtml: Added.

2011-06-04 Jeffrey Pfau <​jpfau@apple.com>

Reviewed by Beth Dakin.

Crash in WebCore::RenderMathMLSubSup::baselinePosition()
​https://bugs.webkit.org/show_bug.cgi?id=57897

Simple patch adding NULL checks in each function.
Test: mathml/msubsup-remove-children.xhtml

  • rendering/mathml/RenderMathMLSubSup.cpp: (WebCore::RenderMathMLSubSup::stretchToHeight): (WebCore::RenderMathMLSubSup::baselinePosition):
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r88095 r88104  
     12011-06-04  Jeffrey Pfau  <jpfau@apple.com>
     2
     3        Reviewed by Beth Dakin.
     4
     5        Crash in WebCore::RenderMathMLSubSup::baselinePosition()
     6        https://bugs.webkit.org/show_bug.cgi?id=57897
     7
     8        Added simple test that hits the relevant code.
     9
     10        * mathml/msubsup-remove-children-expected.txt: Added.
     11        * mathml/msubsup-remove-children.xhtml: Added.
     12
    1132011-06-03  Vangelis Kokkevis  <vangelis@chromium.org>
    214

  • trunk/Source/WebCore/ChangeLog

    r88103 r88104  
     12011-06-04  Jeffrey Pfau  <jpfau@apple.com>
     2
     3        Reviewed by Beth Dakin.
     4
     5        Crash in WebCore::RenderMathMLSubSup::baselinePosition()
     6        https://bugs.webkit.org/show_bug.cgi?id=57897
     7
     8        Simple patch adding NULL checks in each function.
     9        Test: mathml/msubsup-remove-children.xhtml
     10
     11        * rendering/mathml/RenderMathMLSubSup.cpp:
     12        (WebCore::RenderMathMLSubSup::stretchToHeight):
     13        (WebCore::RenderMathMLSubSup::baselinePosition):
     14
    1152011-06-04  Nico Weber  <thakis@chromium.org>
    216

  • trunk/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp

    r75353 r88104  
    107107{
    108108    RenderObject* base = firstChild();
    109     if (!base)
     109    if (!base || !base->firstChild())
    110110        return;
    111111   
    … …  
    186186    case SubSup:
    187187        base = base->firstChild();
     188        if (!base)
     189            break;
     190
    188191        if (m_scripts && base->isBoxModelObject()) {
    189192            RenderBoxModelObject* box = toRenderBoxModelObject(base);
Note: See TracChangeset for help on using the changeset viewer.