+2006-05-20 Mitz Pettel <opendarwin.org@mitzpettel.com>
+
+ Reviewed and landed by ap.
+
+ - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=9009
+ REGRESSION: ToT crash in WebCore at Zap2it
+
+ * fast/table/empty-section-crash-expected.checksum: Added.
+ * fast/table/empty-section-crash-expected.png: Added.
+ * fast/table/empty-section-crash-expected.txt: Added.
+ * fast/table/empty-section-crash.html: Added.
+
2006-05-19 Levi Weintraub <lweintraub@apple.com>
Reviewed by justin.
--- /dev/null
+layer at (0,0) size 800x600
+ RenderCanvas at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x576
+ RenderBlock {P} at (0,0) size 784x18
+ RenderText {#text} at (0,0) size 53x18
+ text run at (0,0) width 53: "Test for "
+ RenderInline {I} at (0,0) size 663x18
+ RenderInline {A} at (0,0) size 348x18 [color=#0000EE]
+ RenderText {#text} at (53,0) size 348x18
+ text run at (53,0) width 348: "http://bugzilla.opendarwin.org/show_bug.cgi?id=9009"
+ RenderText {#text} at (401,0) size 315x18
+ text run at (401,0) width 4: " "
+ text run at (405,0) width 311: "REGRESSION: ToT crash in WebCore at Zap2it"
+ RenderText {#text} at (716,0) size 4x18
+ text run at (716,0) width 4: "."
+ RenderBlock {P} at (0,34) size 784x18
+ RenderText {#text} at (0,0) size 148x18
+ text run at (0,0) width 148: "No crash means PASS."
+layer at (8,-10) size 100x12 backgroundClip at (0,0) size 800x600 clip at (0,0) size 800x600 outlineClip at (0,0) size 800x600
+ RenderTable {TABLE} at (8,-10) size 100x12 [border: (5px solid #000000) none]
+ RenderTableSection {TBODY} at (0,5) size 100x0
+ RenderTableSection {TBODY} at (0,5) size 100x7
+ RenderTableRow {TR} at (0,0) size 100x7
+ RenderTableCell {TD} at (0,0) size 100x7 [border: (5px none #000000)] [r=0 c=0 rs=1 cs=1]
--- /dev/null
+<html>
+<head>
+ <title></title>
+ <script type="text/javascript">
+ function finish()
+ {
+ /* Since the crash happens in painting code, force painting. This
+ makes the test work even when run without the --pixel option. */
+ layoutTestController.display();
+ layoutTestController.notifyDone();
+ }
+
+ function test()
+ {
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ setTimeout(finish, 0);
+ }
+ }
+ </script>
+</head>
+<body onload="test();">
+ <p>
+ Test for <i><a href="http://bugzilla.opendarwin.org/show_bug.cgi?id=9009">http://bugzilla.opendarwin.org/show_bug.cgi?id=9009</a>
+ REGRESSION: ToT crash in WebCore at Zap2it</i>.
+ </p>
+ <p>
+ No crash means PASS.
+ </p>
+ <table style="position: absolute; top: -10px; border-collapse: collapse; border-top: 10px solid; width: 100px; height: 100px;">
+ <tbody></tbody>
+ <tbody><tr><td></td></tr></tbody>
+ </table>
+</body>
+2006-05-20 Mitz Pettel <opendarwin.org@mitzpettel.com>
+
+ Reviewed and landed by ap.
+
+ - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9009
+ REGRESSION: ToT crash in WebCore at Zap2it
+
+ Test: fast/table/empty-section-crash.html
+
+ * rendering/RenderTableSection.cpp:
+ (WebCore::RenderTableSection::paint): Return immediately if the section
+ has 0 rows or 0 columns.
+
2006-05-19 Levi Weintraub <lweintraub@apple.com>
Reviewed by justin.