Check (rather than assume) element is a RenderTableSection before using it
authorbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 22 Apr 2014 18:36:52 +0000 (18:36 +0000)
committerbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 22 Apr 2014 18:36:52 +0000 (18:36 +0000)
commit67bc5c58984882228032f86092a9ea5ac1614421
tree7aab1d6ec1464a030c220d30e8f64a2dcaece3fd
parent97b18f21af3e69c243a86c7be17359f3c776b7e6
Check (rather than assume) element is a RenderTableSection before using it
https://bugs.webkit.org/show_bug.cgi?id=121858

Reviewed by David Kilzer.

Source/WebCore:
Test: fast/table/table-insert-object-before-td-crash.html

* rendering/RenderTable.cpp:
(WebCore::RenderTable::addChild): Check that lastBox is a table section before
using the node as if it was one.

LayoutTests:
* fast/table/table-insert-object-before-td-crash-expected.txt: Added.
* fast/table/table-insert-object-before-td-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@167672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/table/table-insert-object-before-td-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/table/table-insert-object-before-td-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderTable.cpp