WebCore:
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 10 Mar 2009 14:46:42 +0000 (14:46 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 10 Mar 2009 14:46:42 +0000 (14:46 +0000)
commita1e6499a09080390df3fcba91285cc47920073cc
tree3beecea89d30935bac65d6f4a2ee69a498d656a8
parenta949bcf51aa58f6c693b29d6969cc5ec30581340
WebCore:

2009-03-10  Darin Adler  <darin@apple.com>

        Reviewed by Dan Bernstein.

        Bug 23564: REGRESSION (r39230-39286): crash loading page that changes <input> display type and then calls innerHTML
        https://bugs.webkit.org/show_bug.cgi?id=23564
        rdar://problem/6537238

        Test: fast/dom/HTMLElement/innerHTML-selection-crash.html

        * editing/markup.cpp: (WebCore::createMarkup): Added updateLayoutIgnorePendingStylesheets
        call to the one of the two overloads of this function that wasn't calling it. This fixes
        this crash and other possible crashes inside innerHTML.

LayoutTests:

2009-03-10  Darin Adler  <darin@apple.com>

        Reviewed by Dan Bernstein.

        Bug 23564: REGRESSION (r39230-39286): crash loading page that changes <input> display type and then calls innerHTML
        https://bugs.webkit.org/show_bug.cgi?id=23564
        rdar://problem/6537238

        * fast/dom/HTMLElement/innerHTML-selection-crash-expected.txt: Added.
        * fast/dom/HTMLElement/innerHTML-selection-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@41552 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/HTMLElement/innerHTML-selection-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/HTMLElement/innerHTML-selection-crash.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/editing/markup.cpp