git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: d390147)
Reviewed by Darin.
authoradele <adele@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 12 May 2005 01:16:01 +0000 (01:16 +0000)
committeradele <adele@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 12 May 2005 01:16:01 +0000 (01:16 +0000)
        fix for <rdar://problem/4061979> crash in DOM::ElementImpl::setAttribute at www.nitto-kohki.co.jp

        * khtml/html/html_imageimpl.cpp: (HTMLImageLoader::updateFromElement): added a nil check for the document
        * khtml/xml/dom_nodeimpl.h: (DOM::NodeImpl::inDocument): added check for document in case the document has been destroyed before the node has been removed.  A lot of code already assumes that if inDocument returns true, a document exists.

        * layout-tests/fast/events/onload-re-entry.html: removed alert.
        * layout-tests/fast/events/onload-re-entry-expected.txt: updated.
        * layout-tests/fast/dom/attr_dead_doc-expected.txt: Added.
        * layout-tests/fast/dom/attr_dead_doc.html: Added.
        * layout-tests/fast/dom/resources/apple.gif: Added.
        * layout-tests/fast/dom/resources/mozilla.gif: Added.
        * layout-tests/fast/dom/resources/top.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@9162 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/fast/dom/attr_dead_doc-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/dom/attr_dead_doc.html [new file with mode: 0644] patch | blob
LayoutTests/fast/dom/resources/apple.gif [new file with mode: 0644] patch | blob
LayoutTests/fast/dom/resources/mozilla.gif [new file with mode: 0644] patch | blob
LayoutTests/fast/dom/resources/top.html [new file with mode: 0644] patch | blob
LayoutTests/fast/events/onload-re-entry.html patch | blob | history
WebCore/ChangeLog-2005-08-23 patch | blob | history
WebCore/khtml/html/html_imageimpl.cpp patch | blob | history
WebCore/khtml/xml/dom_nodeimpl.h patch | blob | history

diff --git a/LayoutTests/fast/dom/attr_dead_doc-expected.txt b/LayoutTests/fast/dom/attr_dead_doc-expected.txt
new file mode 100644 (file)
index 0000000..962978d
--- /dev/null
+++ b/LayoutTests/fast/dom/attr_dead_doc-expected.txt
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x600
+  RenderCanvas at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderPartObject {IFRAME} at (0,0) size 300x150
+        layer at (0,0) size 285x150
+          RenderCanvas at (0,0) size 285x150
+        layer at (0,0) size 285x8
+          RenderBlock {HTML} at (0,0) size 285x8
+            RenderBody {BODY} at (8,8) size 269x0
+      RenderText {TEXT} at (0,0) size 0x0
+      RenderText {TEXT} at (0,0) size 0x0
+      RenderText {TEXT} at (0,0) size 0x0
diff --git a/LayoutTests/fast/dom/attr_dead_doc.html b/LayoutTests/fast/dom/attr_dead_doc.html
new file mode 100644 (file)
index 0000000..14b953f
Binary files /dev/null and b/LayoutTests/fast/dom/attr_dead_doc.html differ
diff --git a/LayoutTests/fast/dom/resources/apple.gif b/LayoutTests/fast/dom/resources/apple.gif
new file mode 100644 (file)
index 0000000..55844c8
Binary files /dev/null and b/LayoutTests/fast/dom/resources/apple.gif differ
diff --git a/LayoutTests/fast/dom/resources/mozilla.gif b/LayoutTests/fast/dom/resources/mozilla.gif
new file mode 100644 (file)
index 0000000..509b30e
Binary files /dev/null and b/LayoutTests/fast/dom/resources/mozilla.gif differ
diff --git a/LayoutTests/fast/dom/resources/top.html b/LayoutTests/fast/dom/resources/top.html
new file mode 100644 (file)
index 0000000..45dfa7f
Binary files /dev/null and b/LayoutTests/fast/dom/resources/top.html differ
diff --git a/LayoutTests/fast/events/onload-re-entry.html b/LayoutTests/fast/events/onload-re-entry.html
index 6eb51d0631838352bbbace1f5c5b7cf0b2e55247..8c054a148490ab098e6992af957979ea01501bd6 100644 (file)
--- a/LayoutTests/fast/events/onload-re-entry.html
+++ b/LayoutTests/fast/events/onload-re-entry.html
@@ -7,6 +7,6 @@ function write_stuff()
     document.write("<p>" + x + "</p>");
 }
 </script>
-<body onload="alert('child'); write_stuff()">
+<body onload="write_stuff()">
 </body>
 
diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 7aebab6e6b5acd49fd0cd3d6c68fff8bbc4a3b39..4844d38f0057798ae7f33afbffa2182991e703a4 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,20 @@
+2005-05-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin.
+
+        fix for <rdar://problem/4061979> crash in DOM::ElementImpl::setAttribute at www.nitto-kohki.co.jp
+
+        * khtml/html/html_imageimpl.cpp: (HTMLImageLoader::updateFromElement): added a nil check for the document
+        * khtml/xml/dom_nodeimpl.h: (DOM::NodeImpl::inDocument): added check for document in case the document has been destroyed before the node has been removed.  A lot of code already assumes that if inDocument returns true, a document exists.
+ 
+        * layout-tests/fast/events/onload-re-entry.html: removed alert.
+        * layout-tests/fast/events/onload-re-entry-expected.txt: updated.
+        * layout-tests/fast/dom/attr_dead_doc-expected.txt: Added.
+        * layout-tests/fast/dom/attr_dead_doc.html: Added.
+        * layout-tests/fast/dom/resources/apple.gif: Added.
+        * layout-tests/fast/dom/resources/mozilla.gif: Added.
+        * layout-tests/fast/dom/resources/top.html: Added.
+
 2005-05-10  Maciej Stachowiak  <mjs@apple.com>
 
         Reviewed by Kevin.
diff --git a/WebCore/khtml/html/html_imageimpl.cpp b/WebCore/khtml/html/html_imageimpl.cpp
index bfc70134bd8170ea7ede2b5e6fbcd301cc0ecc56..636fee4170dfc48b7c72af21c4c567b17dea3483 100644 (file)
--- a/WebCore/khtml/html/html_imageimpl.cpp
+++ b/WebCore/khtml/html/html_imageimpl.cpp
@@ -70,7 +70,8 @@ void HTMLImageLoader::updateFromElement()
 {
     // If we're not making renderers for the page, then don't load images.  We don't want to slow
     // down the raw HTML parsing case by loading images we don't intend to display.
-    if (!element()->getDocument()->renderer())
+    DocumentImpl* document = element()->getDocument();
+    if (!document || !document->renderer())
         return;
 
     AtomicString attr;
diff --git a/WebCore/khtml/xml/dom_nodeimpl.h b/WebCore/khtml/xml/dom_nodeimpl.h
index caacca6551ef4a4b4b105423f06c10fa6d0d9788..d0309a78544ea65b0ad00e12bc6fd657ebe8f712 100644 (file)
--- a/WebCore/khtml/xml/dom_nodeimpl.h
+++ b/WebCore/khtml/xml/dom_nodeimpl.h
@@ -255,7 +255,8 @@ public:
     bool changed() const    { return m_changed; }
     bool hasChangedChild() const { return m_hasChangedChild; }
     bool isLink() const { return m_isLink; }
-    bool inDocument() const { return m_inDocument; }
+    // inDocument should also make sure a document exists in case the document has been destroyed before the node is removed from the document.
+    bool inDocument() const { return document->document() && m_inDocument; }
     bool styleElement() const { return m_styleElement; }
     bool implicitNode() const { return m_implicit; }
     void setHasID(bool b=true) { m_hasId = b; }
Mirror of the WebKit open source project from svn.webkit.org.