WebCore:
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 15 Jul 2008 22:53:29 +0000 (22:53 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 15 Jul 2008 22:53:29 +0000 (22:53 +0000)
        Reviewed by Dave Hyatt.

        - fix https://bugs.webkit.org/show_bug.cgi?id=19525
          <rdar://problem/5961768> -webkit-box-reflect in hyperlink causes webkit to crash

        Test: fast/reflections/inline-crash.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::setStyle): Added setHasReflection(false).
        Inline flows never have reflections.

LayoutTests:

        Reviewed by Dave Hyatt.

        - test for https://bugs.webkit.org/show_bug.cgi?id=19525
          <rdar://problem/5961768> -webkit-box-reflect in hyperlink causes webkit to crash

        * fast/reflections/inline-crash.html: Added.
        * platform/mac/fast/reflections/inline-crash-expected.checksum: Added.
        * platform/mac/fast/reflections/inline-crash-expected.png: Added.
        * platform/mac/fast/reflections/inline-crash-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@35186 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/reflections/inline-crash.html [new file with mode: 0644]
LayoutTests/platform/mac/fast/reflections/inline-crash-expected.checksum [new file with mode: 0644]
LayoutTests/platform/mac/fast/reflections/inline-crash-expected.png [new file with mode: 0644]
LayoutTests/platform/mac/fast/reflections/inline-crash-expected.txt [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/RenderInline.cpp

index ed3dfec..3a4de0c 100644 (file)
@@ -1,3 +1,15 @@
+2008-07-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - test for https://bugs.webkit.org/show_bug.cgi?id=19525
+          <rdar://problem/5961768> -webkit-box-reflect in hyperlink causes webkit to crash
+
+        * fast/reflections/inline-crash.html: Added.
+        * platform/mac/fast/reflections/inline-crash-expected.checksum: Added.
+        * platform/mac/fast/reflections/inline-crash-expected.png: Added.
+        * platform/mac/fast/reflections/inline-crash-expected.txt: Added.
+
 2008-07-15  Adele Peterson  <adele@apple.com>
 
         Updating results for my fix to <rdar://problem/5784890>.
diff --git a/LayoutTests/fast/reflections/inline-crash.html b/LayoutTests/fast/reflections/inline-crash.html
new file mode 100644 (file)
index 0000000..b012e9e
--- /dev/null
@@ -0,0 +1,25 @@
+<script>
+    onload = function()
+    {
+        if (window.layoutTestController) {
+            layoutTestController.waitUntilDone();
+            layoutTestController.display();
+        }
+        setTimeout(changeColor, 0);
+    }
+
+    changeColor = function()
+    {
+        var span = document.getElementById("span");
+        getSelection().setBaseAndExtent(span, 0, span, 1);
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
+<p>
+    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=19525">https://bugs.webkit.org/show_bug.cgi?id=19525</a>
+    -webkit-box-reflect in hyperlink causes webkit to crash</i>.
+</p>
+<p>
+    Because it is an inline flow, <span id="span" style="-webkit-box-reflect: below;">this span</span> should not have a reflection, and selecting it should not cause a crash.
+</p>
diff --git a/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.checksum b/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.checksum
new file mode 100644 (file)
index 0000000..1626210
--- /dev/null
@@ -0,0 +1 @@
+3f9595d9c6fc298140063a4a3052cd69
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.png b/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.png
new file mode 100644 (file)
index 0000000..10c9901
Binary files /dev/null and b/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.png differ
diff --git a/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.txt b/LayoutTests/platform/mac/fast/reflections/inline-crash-expected.txt
new file mode 100644 (file)
index 0000000..adc2c82
--- /dev/null
@@ -0,0 +1,27 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x576
+      RenderBlock {P} at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 53x18
+          text run at (0,0) width 53: "Test for "
+        RenderInline {I} at (0,0) size 654x18
+          RenderInline {A} at (0,0) size 307x18 [color=#0000EE]
+            RenderText {#text} at (53,0) size 307x18
+              text run at (53,0) width 307: "https://bugs.webkit.org/show_bug.cgi?id=19525"
+          RenderText {#text} at (360,0) size 347x18
+            text run at (360,0) width 4: " "
+            text run at (364,0) width 343: "-webkit-box-reflect in hyperlink causes webkit to crash"
+        RenderText {#text} at (707,0) size 4x18
+          text run at (707,0) width 4: "."
+      RenderBlock {P} at (0,34) size 784x18
+        RenderText {#text} at (0,0) size 178x18
+          text run at (0,0) width 178: "Because it is an inline flow, "
+        RenderInline {SPAN} at (0,0) size 55x18
+          RenderText {#text} at (178,0) size 55x18
+            text run at (178,0) width 55: "this span"
+        RenderText {#text} at (233,0) size 441x18
+          text run at (233,0) width 441: " should not have a reflection, and selecting it should not cause a crash."
+selection start: position 0 of child 0 {#text} of child 1 {SPAN} of child 2 {P} of child 1 {BODY} of child 0 {HTML} of document
+selection end:   position 9 of child 0 {#text} of child 1 {SPAN} of child 2 {P} of child 1 {BODY} of child 0 {HTML} of document
index fdd3707..de460e0 100644 (file)
@@ -1,3 +1,16 @@
+2008-07-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19525
+          <rdar://problem/5961768> -webkit-box-reflect in hyperlink causes webkit to crash
+
+        Test: fast/reflections/inline-crash.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::setStyle): Added setHasReflection(false).
+        Inline flows never have reflections.
+
 2008-07-14  David Hyatt  <hyatt@apple.com>
 
         Allow <style> and <link> pretty much anywhere.  They will still be moved to the <head> if
index eb0a616..60a194a 100644 (file)
@@ -45,6 +45,7 @@ void RenderInline::setStyle(RenderStyle* newStyle)
 {
     RenderFlow::setStyle(newStyle);
     setInline(true);
+    setHasReflection(false);
 
     // Ensure that all of the split inlines pick up the new style. We
     // only do this if we're an inline, since we don't want to propagate