2006-11-14 Rob Buis <buis@kde.org>

        Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=11575
        Bug 11575: REGRESSION: WebCore crash in CSSParser/HTMLTokenizer

        Test: fast/css/css-imports.html

        * css/CSSImportRule.cpp:
        (WebCore::CSSImportRule::insertedIntoParent):
        Fix the crash by testing for null pointer.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17761 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index d4b1c846d5f15900d19879de65f8ef2260a5298a..dfd52435d74dd9b3f94200e13b646e1125418b24 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2006-11-14  Mitz Pettel  <mitz@webkit.org>
+
+        http://bugs.webkit.org/show_bug.cgi?id=11575
+        Bug 11575: REGRESSION: WebCore crash in CSSParser/HTMLTokenizer
+
+        * fast/css/css-imports-expected.checksum: Added.
+        * fast/css/css-imports-expected.png: Added.
+        * fast/css/css-imports-expected.txt: Added.
+        * fast/css/css-imports.html: Added.
+        * fast/css/resources/css-imports-2.css: Added.
+        * fast/css/resources/css-imports.css: Added.
+
 2006-11-13  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by harrison

diff --git a/LayoutTests/fast/css/css-imports-expected.checksum b/LayoutTests/fast/css/css-imports-expected.checksum
new file mode 100644 (file)
index 0000000..fef9703
--- /dev/null
+++ b/LayoutTests/fast/css/css-imports-expected.checksum
@@ -0,0 +1 @@
+ae3c11f7d0d3498c558ff9fabec5bbd4
\ No newline at end of file

diff --git a/LayoutTests/fast/css/css-imports-expected.png b/LayoutTests/fast/css/css-imports-expected.png
new file mode 100644 (file)
index 0000000..1dd0a49
Binary files /dev/null and b/LayoutTests/fast/css/css-imports-expected.png differ

diff --git a/LayoutTests/fast/css/css-imports-expected.txt b/LayoutTests/fast/css/css-imports-expected.txt
new file mode 100644 (file)
index 0000000..d7bd2aa
--- /dev/null
+++ b/LayoutTests/fast/css/css-imports-expected.txt
@@ -0,0 +1,18 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 53x18
+          text run at (0,0) width 53: "Test for "
+        RenderInline {A} at (0,0) size 68x18 [color=#0000EE]
+          RenderText {#text} at (53,0) size 68x18
+            text run at (53,0) width 68: "bug 11575"
+        RenderText {#text} at (121,0) size 421x18
+          text run at (121,0) width 421: ": REGRESSION: WebCore crash in CSSParser/HTMLTokenizer."
+      RenderBlock {P} at (0,34) size 784x36
+        RenderText {#text} at (0,0) size 750x36
+          text run at (0,0) width 750: "All four sides of the square below should be present for this test to really pass, and WebKit shouldn't crash for it to pass"
+          text run at (0,18) width 55: "partially."
+      RenderBlock {DIV} at (0,86) size 106x106 [border: (3px solid #000000)]

diff --git a/LayoutTests/fast/css/css-imports.html b/LayoutTests/fast/css/css-imports.html
new file mode 100644 (file)
index 0000000..8b7ad24
--- /dev/null
+++ b/LayoutTests/fast/css/css-imports.html
@@ -0,0 +1,7 @@
+<p>Test for <a href="http://bugs.webkit.org/show_bug.cgi?id=11575">bug 11575</a>:
+REGRESSION: WebCore crash in CSSParser/HTMLTokenizer.</p>
+<p>All four sides of the square below should be present for this test to really pass,
+and WebKit shouldn't crash for it to pass partially.</p>
+<link rel="stylesheet" type="text/css" href="resources/style.css">
+<style>@import "resources/css-imports.css";</style>
+<div style="border-top: solid; width: 100px; height: 100px;"></div>

diff --git a/LayoutTests/fast/css/resources/css-imports-2.css b/LayoutTests/fast/css/resources/css-imports-2.css
new file mode 100644 (file)
index 0000000..da9bf3b
--- /dev/null
+++ b/LayoutTests/fast/css/resources/css-imports-2.css
@@ -0,0 +1 @@
+div { border-left: solid; }

diff --git a/LayoutTests/fast/css/resources/css-imports.css b/LayoutTests/fast/css/resources/css-imports.css
new file mode 100644 (file)
index 0000000..68531c7
--- /dev/null
+++ b/LayoutTests/fast/css/resources/css-imports.css
@@ -0,0 +1,3 @@
+@import "css-imports-2.css";
+@import "data:text/css,div { border-right: solid; }";
+div { border-bottom: solid; }

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 3a1e6a509c479437fd8f9b8e0a32fb86ef4f9f64..d2682a1ff560c95e7372b8e4f779ac482ac2ab20 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2006-11-14  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11575
+        Bug 11575: REGRESSION: WebCore crash in CSSParser/HTMLTokenizer
+
+        Test: fast/css/css-imports.html
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        Fix the crash by testing for null pointer.
+
 2006-11-14  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Tim H.

diff --git a/WebCore/css/CSSImportRule.cpp b/WebCore/css/CSSImportRule.cpp
index ec10c89a608c3f7351feeebb142ff9a79665d928..2747f18c8771ef5f356f34ebae985d597676b797 100644 (file)
--- a/WebCore/css/CSSImportRule.cpp
+++ b/WebCore/css/CSSImportRule.cpp
@@ -104,7 +104,7 @@ void CSSImportRule::insertedIntoParent()
         // if the import rule is issued dynamically, the sheet may be
         // removed from the pending sheet count, so let the doc know
         // the sheet being imported is pending.
-        if (parentSheet && parentSheet->loadCompleted())
+        if (parentSheet && parentSheet->loadCompleted() && parentSheet->doc())
             parentSheet->doc()->addPendingSheet();
         m_loading = true;
         m_cachedSheet->ref(this);