2009-11-01 Yuta Kitamura <yutak@chromium.org>
authoreric@webkit.org <eric@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 1 Nov 2009 16:03:27 +0000 (16:03 +0000)
committereric@webkit.org <eric@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 1 Nov 2009 16:03:27 +0000 (16:03 +0000)
        Reviewed by Darin Adler.

        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().

        [Crash (debug)] Combination of list-item and :after causes assertion failure
        https://bugs.webkit.org/show_bug.cgi?id=30944

        * fast/css/list-item-pseudo-nocrash-expected.txt: Added.
        * fast/css/list-item-pseudo-nocrash.html: Added.
2009-11-01  Yuta Kitamura  <yutak@chromium.org>

        Reviewed by Darin Adler.

        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().

        [Crash (debug)] Combination of list-item and :after causes assertion failure
        https://bugs.webkit.org/show_bug.cgi?id=30944

        Test: fast/css/list-item-pseudo-nocrash.html

        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::updateBeforeAfterContent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@50386 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css/list-item-pseudo-nocrash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/list-item-pseudo-nocrash.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/RenderObjectChildList.cpp

index bc6efc7..5a6285c 100644 (file)
@@ -1,3 +1,15 @@
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        * fast/css/list-item-pseudo-nocrash-expected.txt: Added.
+        * fast/css/list-item-pseudo-nocrash.html: Added.
+
 2009-11-01  Philippe Normand  <pnormand@igalia.com>
 
         Reviewed by Eric Seidel.
diff --git a/LayoutTests/fast/css/list-item-pseudo-nocrash-expected.txt b/LayoutTests/fast/css/list-item-pseudo-nocrash-expected.txt
new file mode 100644 (file)
index 0000000..01a31c2
--- /dev/null
@@ -0,0 +1,3 @@
+This is a test for bug 30944. Passes if it does not crash.
+
+Hover me
diff --git a/LayoutTests/fast/css/list-item-pseudo-nocrash.html b/LayoutTests/fast/css/list-item-pseudo-nocrash.html
new file mode 100644 (file)
index 0000000..bb01236
--- /dev/null
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <title>List-item + :after pseudo-class</title>
+        <style type="text/css">
+#anchor {
+    display: block;
+}
+#anchor:hover {}
+#anchor:after {
+    content: ".";
+    display: block;
+}
+span {
+    float: left;
+}
+        </style>
+        <script type="application/javascript">
+function run() {
+    if (!window.layoutTestController)
+        return;
+
+    window.layoutTestController.dumpAsText();
+    window.layoutTestController.waitUntilDone();
+    window.eventSender.mouseMoveTo(0, 0);
+    window.setTimeout(hover, 100);
+}
+
+function hover() {
+    var element = document.getElementById('text');
+    var x = element.offsetLeft + element.offsetWidth / 2;
+    var y = element.offsetTop + element.offsetHeight / 2;
+    window.eventSender.mouseMoveTo(x, y);
+    window.setTimeout(finalize, 100);
+}
+
+function finalize() {
+    window.layoutTestController.notifyDone();
+}
+
+window.addEventListener('load', run, false);
+        </script>
+    </head>
+    <body>
+        <p>This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30944">bug 30944</a>. Passes if it does not crash.</p>
+        <ul>
+            <li>
+                <a id="anchor" href="#"><span id="text">Hover me</span></a>
+            </li>
+        </ul>
+    </body>
+</html>
index f23a322..6e51389 100644 (file)
@@ -1,3 +1,17 @@
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        Test: fast/css/list-item-pseudo-nocrash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
 2009-11-01  Philippe Normand  <pnormand@igalia.com>
 
         Reviewed by Eric Seidel.
index 23ab98f..fa19547 100644 (file)
@@ -369,9 +369,11 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                     RefPtr<RenderStyle> style = RenderStyle::create();
                     style->inheritFrom(pseudoElementStyle);
                     genChild->setStyle(style.release());
-                } else
-                    // Must be a first-letter container. updateFirstLetter() will take care of it.
-                    ASSERT(genChild->style()->styleType() == FIRST_LETTER);
+                } else {
+                    // RenderListItem may insert a list marker here. We do not need to care about this case.
+                    // Otherwise, genChild must be a first-letter container. updateFirstLetter() will take care of it.
+                    ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER);
+                }
             }
         }
         return; // We've updated the generated content. That's all we needed to do.