git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 79b7838)
2006-05-20 Mitz Pettel <opendarwin.org@mitzpettel.com>
authorap <ap@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 20 May 2006 08:47:37 +0000 (08:47 +0000)
committerap <ap@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 20 May 2006 08:47:37 +0000 (08:47 +0000)
        Reviewed and landed by ap.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9009
          REGRESSION: ToT crash in WebCore at Zap2it

        Test: fast/table/empty-section-crash.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint): Return immediately if the section
        has 0 rows or 0 columns.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@14500 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/table/empty-section-crash-expected.checksum [new file with mode: 0644] patch | blob
LayoutTests/fast/table/empty-section-crash-expected.png [new file with mode: 0644] patch | blob
LayoutTests/fast/table/empty-section-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/table/empty-section-crash.html [new file with mode: 0644] patch | blob
WebCore/ChangeLog patch | blob | history
WebCore/rendering/RenderTableSection.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index abfb5b56be6ac656c8d2ee566698902c7e80209a..a125b0f83b2cb4702f60512a267fa911f9398158 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2006-05-20  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed and landed by ap.
+
+        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=9009
+          REGRESSION: ToT crash in WebCore at Zap2it
+
+        * fast/table/empty-section-crash-expected.checksum: Added.
+        * fast/table/empty-section-crash-expected.png: Added.
+        * fast/table/empty-section-crash-expected.txt: Added.
+        * fast/table/empty-section-crash.html: Added.
+
 2006-05-19  Levi Weintraub  <lweintraub@apple.com>
 
         Reviewed by justin.
diff --git a/LayoutTests/fast/table/empty-section-crash-expected.checksum b/LayoutTests/fast/table/empty-section-crash-expected.checksum
new file mode 100644 (file)
index 0000000..f14d5ec
--- /dev/null
+++ b/LayoutTests/fast/table/empty-section-crash-expected.checksum
@@ -0,0 +1,2 @@
+8de15f179269e793e5a6148cc0553254
+\ No newline at end of file
diff --git a/LayoutTests/fast/table/empty-section-crash-expected.png b/LayoutTests/fast/table/empty-section-crash-expected.png
new file mode 100644 (file)
index 0000000..fef5aae
Binary files /dev/null and b/LayoutTests/fast/table/empty-section-crash-expected.png differ
diff --git a/LayoutTests/fast/table/empty-section-crash-expected.txt b/LayoutTests/fast/table/empty-section-crash-expected.txt
new file mode 100644 (file)
index 0000000..92c0ab2
--- /dev/null
+++ b/LayoutTests/fast/table/empty-section-crash-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  RenderCanvas at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x576
+      RenderBlock {P} at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 53x18
+          text run at (0,0) width 53: "Test for "
+        RenderInline {I} at (0,0) size 663x18
+          RenderInline {A} at (0,0) size 348x18 [color=#0000EE]
+            RenderText {#text} at (53,0) size 348x18
+              text run at (53,0) width 348: "http://bugzilla.opendarwin.org/show_bug.cgi?id=9009"
+          RenderText {#text} at (401,0) size 315x18
+            text run at (401,0) width 4: " "
+            text run at (405,0) width 311: "REGRESSION: ToT crash in WebCore at Zap2it"
+        RenderText {#text} at (716,0) size 4x18
+          text run at (716,0) width 4: "."
+      RenderBlock {P} at (0,34) size 784x18
+        RenderText {#text} at (0,0) size 148x18
+          text run at (0,0) width 148: "No crash means PASS."
+layer at (8,-10) size 100x12 backgroundClip at (0,0) size 800x600 clip at (0,0) size 800x600 outlineClip at (0,0) size 800x600
+  RenderTable {TABLE} at (8,-10) size 100x12 [border: (5px solid #000000) none]
+    RenderTableSection {TBODY} at (0,5) size 100x0
+    RenderTableSection {TBODY} at (0,5) size 100x7
+      RenderTableRow {TR} at (0,0) size 100x7
+        RenderTableCell {TD} at (0,0) size 100x7 [border: (5px none #000000)] [r=0 c=0 rs=1 cs=1]
diff --git a/LayoutTests/fast/table/empty-section-crash.html b/LayoutTests/fast/table/empty-section-crash.html
new file mode 100644 (file)
index 0000000..6c1cf26
--- /dev/null
+++ b/LayoutTests/fast/table/empty-section-crash.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        function finish()
+        {
+            /* Since the crash happens in painting code, force painting. This
+               makes the test work even when run without the --pixel option. */
+            layoutTestController.display();
+            layoutTestController.notifyDone();
+        }
+
+        function test()
+        {
+            if (window.layoutTestController) {
+                layoutTestController.waitUntilDone();
+                setTimeout(finish, 0);
+            }
+        }
+    </script>
+</head>
+<body onload="test();">
+    <p>
+        Test for <i><a href="http://bugzilla.opendarwin.org/show_bug.cgi?id=9009">http://bugzilla.opendarwin.org/show_bug.cgi?id=9009</a>
+        REGRESSION: ToT crash in WebCore at Zap2it</i>.
+    </p>
+    <p>
+        No crash means PASS.
+    </p>
+    <table style="position: absolute; top: -10px; border-collapse: collapse; border-top: 10px solid; width: 100px; height: 100px;">
+    <tbody></tbody>
+    <tbody><tr><td></td></tr></tbody>
+    </table>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index db8b2acd0a532b78053afbb0dd14106d0229befc..4d6d8a434d37833605be15ad18f028ade542c34c 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2006-05-20  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed and landed by ap.
+
+        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9009
+          REGRESSION: ToT crash in WebCore at Zap2it
+
+        Test: fast/table/empty-section-crash.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint): Return immediately if the section
+        has 0 rows or 0 columns.
+
 2006-05-19  Levi Weintraub  <lweintraub@apple.com>
 
         Reviewed by justin.
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index f94f9e129f8db964896d10b735f98b9ba65df242..8728f389521b142d371064f499598c406fb8d0f3 100644 (file)
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -829,6 +829,9 @@ void RenderTableSection::paint(PaintInfo& i, int tx, int ty)
     unsigned int totalRows = gridRows;
     unsigned int totalCols = table()->columns.size();
 
+    if (totalRows == 0 || totalCols == 0)
+        return;
+
     tx += m_x;
     ty += m_y;
 
Mirror of the WebKit open source project from svn.webkit.org.