WebCore:
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 Nov 2007 20:59:00 +0000 (20:59 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 Nov 2007 20:59:00 +0000 (20:59 +0000)
        Reviewed by Dave Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15887
          REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg

        Test: fast/css/display-none-inline-style-change-crash.html

        * dom/Element.cpp:
        (WebCore::Element::recalcStyle): Fixed the crash by null-checking
        the current style and removed other checks that are not strictly
        necessary.

LayoutTests:

        Reviewed by Dave Hyatt.

        - test for http://bugs.webkit.org/show_bug.cgi?id=15887
          REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg

        * fast/css/display-none-inline-style-change-crash-expected.txt: Added.
        * fast/css/display-none-inline-style-change-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27579 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css/display-none-inline-style-change-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/display-none-inline-style-change-crash.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/dom/Element.cpp

index 391fb4e8ab8b6938af925062806193c2f8e45cd8..9d674ad000f4fdb9ba89fd617950e8819bfd7978 100644 (file)
@@ -1,3 +1,13 @@
+2007-11-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - test for http://bugs.webkit.org/show_bug.cgi?id=15887
+          REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg
+
+        * fast/css/display-none-inline-style-change-crash-expected.txt: Added.
+        * fast/css/display-none-inline-style-change-crash.html: Added.
+
 2007-11-07  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/css/display-none-inline-style-change-crash-expected.txt b/LayoutTests/fast/css/display-none-inline-style-change-crash-expected.txt
new file mode 100644 (file)
index 0000000..030c289
--- /dev/null
@@ -0,0 +1,3 @@
+Test for http://bugs.webkit.org/show_bug.cgi?id=15887 REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg.
+
+This test should not crash.
diff --git a/LayoutTests/fast/css/display-none-inline-style-change-crash.html b/LayoutTests/fast/css/display-none-inline-style-change-crash.html
new file mode 100644 (file)
index 0000000..0e44873
--- /dev/null
@@ -0,0 +1,16 @@
+<style>
+    /* dummy descendant rule */
+    span li { color: red; }
+</style>
+<p>
+    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15887">http://bugs.webkit.org/show_bug.cgi?id=15887</a> REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg</i>.
+</p>
+<p>
+    This test should not crash.
+</p>
+<div id="target" style="display: none;"></div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    document.getElementById("target").style.color = "blue";
+</script>
index 898dded57f92295af645be76d903c05516958e02..655de140b5b4304cb5b0557986818116d9a0a725 100644 (file)
@@ -1,3 +1,17 @@
+2007-11-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15887
+          REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg
+
+        Test: fast/css/display-none-inline-style-change-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Fixed the crash by null-checking
+        the current style and removed other checks that are not strictly
+        necessary.
+
 2007-11-07  Tristan O'Tierney  <tristan@apple.com>
 
         Reviewed by Kevin Decker.
index 5f602de21658c821792237c1438cc8425f080bae..d16e5ba4ace71ac1de5f01bd6c0760fd6aac522a 100644 (file)
@@ -724,7 +724,7 @@ void Element::recalcStyle(StyleChange change)
             return;
         }
 
-        if (newStyle && change != Force && styleChangeType() != FullStyleChange && document()->usesDescendantRules()) {
+        if (currentStyle && newStyle) {
             // Preserve "affected by" bits that were propagated to us from descendants
             if (currentStyle->affectedByHoverRules())
                 newStyle->setAffectedByHoverRules(true);