Source/WebCore: Hold refptr to identified previous sibling within findPlaceForCounter.
authorcdn@chromium.org <cdn@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 4 Oct 2011 19:47:32 +0000 (19:47 +0000)
committercdn@chromium.org <cdn@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 4 Oct 2011 19:47:32 +0000 (19:47 +0000)
commite654136d862b1539c72a73e245d6acac7a664fc8
treec1057365c6a3d793c81bfd6045107ffc04b66f2e
parentf41236b70b19e4e548922b3aa3e164202525622e
Source/WebCore: Hold refptr to identified previous sibling within findPlaceForCounter.
https://bugs.webkit.org/show_bug.cgi?id=68563

Reviewed by Adam Barth.

Test: fast/css/counters/counter-after-style-crash.html

* rendering/RenderCounter.cpp:
(WebCore::findPlaceForCounter):

LayoutTests: Add test for crash when performing rich text mutations with counter nodes.
https://bugs.webkit.org/show_bug.cgi?id=68563

Reviewed by Adam Barth.

* fast/css/counters/counter-after-style-crash-expected.txt: Added.
* fast/css/counters/counter-after-style-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@96632 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/counters/counter-after-style-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderCounter.cpp