Changeset 93032 in webkit

Timestamp:

Aug 14, 2011 4:08:11 PM (13 years ago)

Author:

inferno@chromium.org

Message:

Source/WebCore: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody
​https://bugs.webkit.org/show_bug.cgi?id=66187

Reviewed by Adam Barth.

RefPtr a few ContainerNodes to prevent premature deletion.

Test: fast/html/process-end-tag-for-inbody-crash.html

• html/parser/HTMLTreeBuilder.cpp:

(WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
(WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
(WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

LayoutTests: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody.
​https://bugs.webkit.org/show_bug.cgi?id=66187

Reviewed by Adam Barth.

• fast/html/process-end-tag-for-inbody-crash-expected.txt: Added.
• fast/html/process-end-tag-for-inbody-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/process-end-tag-for-inbody-crash-expected.txt (added)
• LayoutTests/fast/html/process-end-tag-for-inbody-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/HTMLTreeBuilder.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-08-13  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody.
+        https://bugs.webkit.org/show_bug.cgi?id=66187
+
+        Reviewed by Adam Barth.
+
+        * fast/html/process-end-tag-for-inbody-crash-expected.txt: Added.
+        * fast/html/process-end-tag-for-inbody-crash.html: Added.
+
 2011-08-12  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-08-13  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody
+        https://bugs.webkit.org/show_bug.cgi?id=66187
+
+        Reviewed by Adam Barth.
+
+        RefPtr a few ContainerNodes to prevent premature deletion.
+
+        Test: fast/html/process-end-tag-for-inbody-crash.html
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
+        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
 2011-08-14  Kalev Lember  <kalevlember@gmail.com>
 

trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp

@@ -606 +606 @@
     HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
     while (1) {
-        ContainerNode* node = nodeRecord->node();
-        if (shouldClose(node)) {
+        RefPtr<ContainerNode> node = nodeRecord->node();
+        if (shouldClose(node.get())) {
             ASSERT(node->isElementNode());
-            processFakeEndTag(toElement(node)->tagQName());
+            processFakeEndTag(toElement(node.get())->tagQName());
             break;
         }
-        if (isSpecialNode(node) && !node->hasTagName(addressTag) && !node->hasTagName(divTag) && !node->hasTagName(pTag))
+        if (isSpecialNode(node.get()) && !node->hasTagName(addressTag) && !node->hasTagName(divTag) && !node->hasTagName(pTag))
             break;
         nodeRecord = nodeRecord->next();
@@ -1557 +1557 @@
     HTMLElementStack::ElementRecord* record = m_tree.openElements()->topRecord();
     while (1) {
-        ContainerNode* node = record->node();
+        RefPtr<ContainerNode> node = record->node();
         if (node->hasLocalName(token.name())) {
             m_tree.generateImpliedEndTags();
@@ -1571 +1571 @@
                 // We might have already popped the node for the token in
                 // generateImpliedEndTags, just abort.
-                if (!m_tree.openElements()->contains(toElement(node)))
+                if (!m_tree.openElements()->contains(toElement(node.get())))
                     return;
             }
-            m_tree.openElements()->popUntilPopped(toElement(node));
-            return;
-        }
-        if (isSpecialNode(node)) {
+            m_tree.openElements()->popUntilPopped(toElement(node.get()));
+            return;
+        }
+        if (isSpecialNode(node.get())) {
             parseError(token);
             return;
@@ -1634 +1634 @@
         // 4.
         ASSERT(furthestBlock->isAbove(formattingElementRecord));
-        ContainerNode* commonAncestor = formattingElementRecord->next()->node();
+        RefPtr<ContainerNode> commonAncestor = formattingElementRecord->next()->node();
         // 5.
         HTMLFormattingElementList::Bookmark bookmark = m_tree.activeFormattingElements()->bookmarkFor(formattingElement);