<rdar://problem/9755843> anonymous RenderMathMLOperator sets itself as the renderer...
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 2 Sep 2011 22:22:16 +0000 (22:22 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 2 Sep 2011 22:22:16 +0000 (22:22 +0000)
Reviewed by Darin Adler.

Source/WebCore:

Test: mathml/operator-hijacks-fenced-node.xhtml

* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::updateFromElement): Rather than unconditionally setting the
node’s renderer to this, just restore it to whatever it was before calling destroyLeftoverChildren().

LayoutTests:

* mathml/operator-hijacks-fenced-node-expected.txt: Added.
* mathml/operator-hijacks-fenced-node.xhtml: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94455 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt [new file with mode: 0644]
LayoutTests/mathml/operator-hijacks-fenced-node.xhtml [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp

index 4723d1bbb2ce5e199a8674b5b330093a53f24735..ef4af36be13ed255beeb0e849b33325af08ca37f 100644 (file)
@@ -1,3 +1,12 @@
+2011-09-02  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/9755843> anonymous RenderMathMLOperator sets itself as the renderer of its parent mfenced node
+
+        Reviewed by Darin Adler.
+
+        * mathml/operator-hijacks-fenced-node-expected.txt: Added.
+        * mathml/operator-hijacks-fenced-node.xhtml: Added.
+
 2011-09-02  Tom Sepez  <tsepez@chromium.org>
 
         Add LayoutTest for the case where long strings are processed by the XSSAuditor.
diff --git a/LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt b/LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt
new file mode 100644 (file)
index 0000000..804a4e7
--- /dev/null
@@ -0,0 +1,3 @@
+This tests that an anonymous operator created by mfenced does not set itself as the mfenced node’s renderer.
+
+The test passes if it does not crash or cause an assertion failure.
diff --git a/LayoutTests/mathml/operator-hijacks-fenced-node.xhtml b/LayoutTests/mathml/operator-hijacks-fenced-node.xhtml
new file mode 100644 (file)
index 0000000..6b76b3c
--- /dev/null
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+    <p>
+        This tests that an anonymous operator created by mfenced does not
+        set itself as the mfenced node&#x2019;s renderer.
+    </p>
+    <p>
+        The test passes if it does not crash or cause an assertion failure.
+    </p>
+    <div id="container">
+        <m:math><span><m:mfenced id="target"><m:mo></m:mo></m:mfenced></span></m:math>
+    </div>
+    <script><![CDATA[
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        document.body.offsetTop;
+        document.getElementById("target").parentNode.insertBefore(document.createElement("div"), document.getElementById("target"));
+        document.body.offsetTop;
+        document.getElementById("container").style.display = "none";
+    ]]></script>
+</body>
+</html>
index a791942191082afa96f9a859aab9763223c4e725..123b81c7570e11c0a310f7bd1e06742ee3c49a97 100644 (file)
@@ -1,3 +1,15 @@
+2011-09-02  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/9755843> anonymous RenderMathMLOperator sets itself as the renderer of its parent mfenced node
+
+        Reviewed by Darin Adler.
+
+        Test: mathml/operator-hijacks-fenced-node.xhtml
+
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::updateFromElement): Rather than unconditionally setting the
+        node’s renderer to this, just restore it to whatever it was before calling destroyLeftoverChildren().
+
 2011-09-02  Mark Hahnenberg  <mhahnenberg@apple.com>
 
         Incorporate newer, faster dtoa library
index 7f039b96d9e8f3471d796a3777652fff17db1d19..4734b2a018d3af4b42f1ff970fd4ec829404c4a3 100644 (file)
@@ -124,12 +124,14 @@ static const float gMinimumRatioForStretch = 0.10f;
 
 void RenderMathMLOperator::updateFromElement()
 {
+    RenderObject* savedRenderer = node()->renderer();
+
     // Destroy our current children
     children()->destroyLeftoverChildren();
 
-    // Since we share a node with our children, destroying our children will set our node's
-    // renderer to 0, so we need to re-set it back to this.
-    node()->setRenderer(this);
+    // Since we share a node with our children, destroying our children may set our node's
+    // renderer to 0, so we need to restore it.
+    node()->setRenderer(savedRenderer);
     
     // If the operator is fixed, it will be contained in m_operator
     UChar firstChar = m_operator;