LayoutTests:
authordarin <darin@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Aug 2006 15:22:52 +0000 (15:22 +0000)
committerdarin <darin@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Aug 2006 15:22:52 +0000 (15:22 +0000)
        Reviewed by Anders.

        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
          REGRESSION: Repro crash when loading an empty image document

        * fast/tokenizer/image-empty-crash-expected.txt: Added.
        * fast/tokenizer/image-empty-crash.html: Added.

WebCore:

        Reviewed by Anders.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
          REGRESSION: Repro crash when loading an empty image document

        Test: fast/tokenizer/image-empty-crash.html

        * loader/ImageDocument.cpp:
        (WebCore::ImageTokenizer::stopParsing): Added null check for m_imageElement.
        (WebCore::ImageTokenizer::finish): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15766 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/tokenizer/image-empty-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/tokenizer/image-empty-crash.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/loader/ImageDocument.cpp

index 27997b83e6db184de84e766e93f55ba7dd909715..922334a52517604f006077667c2be490ab279893 100644 (file)
@@ -1,3 +1,13 @@
+2006-08-03  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Anders.
+
+        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
+          REGRESSION: Repro crash when loading an empty image document
+
+        * fast/tokenizer/image-empty-crash-expected.txt: Added.
+        * fast/tokenizer/image-empty-crash.html: Added.
+
 2006-08-02  Alexey Proskuryakov  <ap@nypop.com>
 
         Reviewed by Darin.
diff --git a/LayoutTests/fast/tokenizer/image-empty-crash-expected.txt b/LayoutTests/fast/tokenizer/image-empty-crash-expected.txt
new file mode 100644 (file)
index 0000000..7ca11a5
--- /dev/null
@@ -0,0 +1,5 @@
+This is a test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10202 REGRESSION: Repro crash when loading an empty image document.
+
+No crash means test PASS.
+
+
diff --git a/LayoutTests/fast/tokenizer/image-empty-crash.html b/LayoutTests/fast/tokenizer/image-empty-crash.html
new file mode 100644 (file)
index 0000000..9de4b0e
--- /dev/null
@@ -0,0 +1,20 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        This is a test for <i><a href="http://bugzilla.opendarwin.org/show_bug.cgi?id=10202">http://bugzilla.opendarwin.org/show_bug.cgi?id=10202</a>
+        REGRESSION: Repro crash when loading an empty image document</i>.
+    </p>
+    <p>
+        No crash means test PASS.
+    </p>
+    <hr>
+    <iframe src="data:image/png,"></iframe>
+</body>
+</html>
index f3f9a5007d744b10369b8f58b6ee255793f064c1..6178ce9a8e9328d092949dc1a32364e9d9ea598c 100644 (file)
@@ -1,3 +1,16 @@
+2006-08-03  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Anders.
+
+        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=10202
+          REGRESSION: Repro crash when loading an empty image document
+
+        Test: fast/tokenizer/image-empty-crash.html
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::stopParsing): Added null check for m_imageElement.
+        (WebCore::ImageTokenizer::finish): Ditto.
+
 2006-08-03  Darin Adler  <darin@apple.com>
 
         Reviewed by Anders.
index 6637fc5a36a48b27c743cd195e4a0068ff5f3af9..7826084fac926fb11e208927be24180703244c1f 100644 (file)
@@ -101,12 +101,13 @@ bool ImageTokenizer::writeRawData(const char* data, int len)
 void ImageTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    m_imageElement->cachedImage()->error();
+    if (m_imageElement)
+        m_imageElement->cachedImage()->error();
 }
 
 void ImageTokenizer::finish()
 {
-    if (!m_parserStopped) {
+    if (!m_parserStopped && m_imageElement) {
         CachedImage* cachedImage = m_imageElement->cachedImage();
         Vector<char>& buffer = cachedImage->bufferData(0, 0, 0);
         cachedImage->data(buffer, true);