git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 45e23c2)
LayoutTests:
authordarin <darin@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Aug 2006 15:22:52 +0000 (15:22 +0000)
committerdarin <darin@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Aug 2006 15:22:52 +0000 (15:22 +0000)
        Reviewed by Anders.

        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
          REGRESSION: Repro crash when loading an empty image document

        * fast/tokenizer/image-empty-crash-expected.txt: Added.
        * fast/tokenizer/image-empty-crash.html: Added.

WebCore:

        Reviewed by Anders.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
          REGRESSION: Repro crash when loading an empty image document

        Test: fast/tokenizer/image-empty-crash.html

        * loader/ImageDocument.cpp:
        (WebCore::ImageTokenizer::stopParsing): Added null check for m_imageElement.
        (WebCore::ImageTokenizer::finish): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15766 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/tokenizer/image-empty-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/tokenizer/image-empty-crash.html [new file with mode: 0644] patch | blob
WebCore/ChangeLog patch | blob | history
WebCore/loader/ImageDocument.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 27997b83e6db184de84e766e93f55ba7dd909715..922334a52517604f006077667c2be490ab279893 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2006-08-03  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Anders.
+
+        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
+          REGRESSION: Repro crash when loading an empty image document
+
+        * fast/tokenizer/image-empty-crash-expected.txt: Added.
+        * fast/tokenizer/image-empty-crash.html: Added.
+
 2006-08-02  Alexey Proskuryakov  <ap@nypop.com>
 
         Reviewed by Darin.
diff --git a/LayoutTests/fast/tokenizer/image-empty-crash-expected.txt b/LayoutTests/fast/tokenizer/image-empty-crash-expected.txt
new file mode 100644 (file)
index 0000000..7ca11a5
--- /dev/null
+++ b/LayoutTests/fast/tokenizer/image-empty-crash-expected.txt
@@ -0,0 +1,5 @@
+This is a test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10202 REGRESSION: Repro crash when loading an empty image document.
+
+No crash means test PASS.
+
+
diff --git a/LayoutTests/fast/tokenizer/image-empty-crash.html b/LayoutTests/fast/tokenizer/image-empty-crash.html
new file mode 100644 (file)
index 0000000..9de4b0e
--- /dev/null
+++ b/LayoutTests/fast/tokenizer/image-empty-crash.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        This is a test for <i><a href="http://bugzilla.opendarwin.org/show_bug.cgi?id=10202">http://bugzilla.opendarwin.org/show_bug.cgi?id=10202</a>
+        REGRESSION: Repro crash when loading an empty image document</i>.
+    </p>
+    <p>
+        No crash means test PASS.
+    </p>
+    <hr>
+    <iframe src="data:image/png,"></iframe>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index f3f9a5007d744b10369b8f58b6ee255793f064c1..6178ce9a8e9328d092949dc1a32364e9d9ea598c 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2006-08-03  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Anders.
+
+        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
+          REGRESSION: Repro crash when loading an empty image document
+
+        Test: fast/tokenizer/image-empty-crash.html
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::stopParsing): Added null check for m_imageElement.
+        (WebCore::ImageTokenizer::finish): Ditto.
+
 2006-08-03  Darin Adler  <darin@apple.com>
 
         Reviewed by Anders.
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index 6637fc5a36a48b27c743cd195e4a0068ff5f3af9..7826084fac926fb11e208927be24180703244c1f 100644 (file)
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -101,12 +101,13 @@ bool ImageTokenizer::writeRawData(const char* data, int len)
 void ImageTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    m_imageElement->cachedImage()->error();
+    if (m_imageElement)
+        m_imageElement->cachedImage()->error();
 }
 
 void ImageTokenizer::finish()
 {
-    if (!m_parserStopped) {
+    if (!m_parserStopped && m_imageElement) {
         CachedImage* cachedImage = m_imageElement->cachedImage();
         Vector<char>& buffer = cachedImage->bufferData(0, 0, 0);
         cachedImage->data(buffer, true);
Mirror of the WebKit open source project from svn.webkit.org.