2011-04-07 Maciej Stachowiak <mjs@apple.com>
authormjs@apple.com <mjs@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 8 Apr 2011 06:01:59 +0000 (06:01 +0000)
committermjs@apple.com <mjs@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 8 Apr 2011 06:01:59 +0000 (06:01 +0000)
        Reviewed by Simon Fraser.

        REGRESSION (r80871): Crash when visiting http://broadband.biglobe.ne.jp/
        https://bugs.webkit.org/show_bug.cgi?id=56297
        <rdar://problem/9131597>

        Test: fast/css-generated-content/table-row-after-no-crash.html

        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::styleDidChange): Factor out generation of before/after
        content, and only do it if the row already has a parent. For construction of
        anonymous cells to work correctly, the row needs to already have a parent, so
        in that case wait a bit.
        (WebCore::RenderTableRow::updateBeforeAndAfterContent): Factored out to here.
        * rendering/RenderTableRow.h:
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::addChild): When adding a row, update its
        before/after content, in case it had any.
2011-04-07  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Simon Fraser.

        REGRESSION (r80871): Crash when visiting http://broadband.biglobe.ne.jp/
        https://bugs.webkit.org/show_bug.cgi?id=56297
        <rdar://problem/9131597>

        * fast/css-generated-content/table-row-after-no-crash-expected.txt: Added.
        * fast/css-generated-content/table-row-after-no-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@83255 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css-generated-content/table-row-after-no-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css-generated-content/table-row-after-no-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderTableRow.cpp
Source/WebCore/rendering/RenderTableRow.h
Source/WebCore/rendering/RenderTableSection.cpp

index 4d0be3a..5154bb0 100644 (file)
@@ -1,3 +1,14 @@
+2011-04-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r80871): Crash when visiting http://broadband.biglobe.ne.jp/
+        https://bugs.webkit.org/show_bug.cgi?id=56297
+        <rdar://problem/9131597>
+
+        * fast/css-generated-content/table-row-after-no-crash-expected.txt: Added.
+        * fast/css-generated-content/table-row-after-no-crash.html: Added.
+
 2011-04-07  Ryosuke Niwa  <rniwa@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/css-generated-content/table-row-after-no-crash-expected.txt b/LayoutTests/fast/css-generated-content/table-row-after-no-crash-expected.txt
new file mode 100644 (file)
index 0000000..fac4c7b
--- /dev/null
@@ -0,0 +1,3 @@
+This test should load without crashing. It checks that generated content in tables is initialized properly.
+
+       
diff --git a/LayoutTests/fast/css-generated-content/table-row-after-no-crash.html b/LayoutTests/fast/css-generated-content/table-row-after-no-crash.html
new file mode 100644 (file)
index 0000000..a614935
--- /dev/null
@@ -0,0 +1,23 @@
+<html>
+  <head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+    <style>
+      body :after {
+        content: ".";
+      }
+    </style>
+  </head>
+  <body>
+<p>This test should load without crashing. It checks that generated
+content in tables is initialized properly.</p>
+    <table style="border-collapse: collapse;">
+      <tr>
+        <td><input type="text"></td>
+        <td><input type="submit"></td>
+      </tr>
+    </table>
+  </body>
+</html>
index 20476c0..e393ff4 100644 (file)
@@ -1,3 +1,24 @@
+2011-04-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r80871): Crash when visiting http://broadband.biglobe.ne.jp/
+        https://bugs.webkit.org/show_bug.cgi?id=56297
+        <rdar://problem/9131597>
+
+        Test: fast/css-generated-content/table-row-after-no-crash.html
+
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleDidChange): Factor out generation of before/after
+        content, and only do it if the row already has a parent. For construction of
+        anonymous cells to work correctly, the row needs to already have a parent, so
+        in that case wait a bit.
+        (WebCore::RenderTableRow::updateBeforeAndAfterContent): Factored out to here.
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): When adding a row, update its
+        before/after content, in case it had any.
+
 2011-04-07  Beth Dakin  <bdakin@apple.com>
 
         Reviewed by Simon Fraser.
index a29f218..2edcfc4 100644 (file)
@@ -63,17 +63,23 @@ void RenderTableRow::styleWillChange(StyleDifference diff, const RenderStyle* ne
     RenderBox::styleWillChange(diff, newStyle);
 }
 
-void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+void RenderTableRow::updateBeforeAndAfterContent()
 {
-    RenderBox::styleDidChange(diff, oldStyle);
-
-    // Update pseudos for :before and :after now.
     if (!isAnonymous() && document()->usesBeforeAfterRules()) {
         children()->updateBeforeAfterContent(this, BEFORE);
         children()->updateBeforeAfterContent(this, AFTER);
     }
 }
 
+void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBox::styleDidChange(diff, oldStyle);
+
+    if (parent())
+        updateBeforeAndAfterContent();
+
+}
+
 void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
index 2af8dcb..570a7f2 100644 (file)
@@ -39,6 +39,8 @@ public:
     RenderTableSection* section() const { return toRenderTableSection(parent()); }
     RenderTable* table() const { return toRenderTable(parent()->parent()); }
 
+    void updateBeforeAndAfterContent();
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
index 8f80c6f..6b080b8 100644 (file)
@@ -144,6 +144,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
 
     ASSERT(!beforeChild || beforeChild->isTableRow());
     RenderBox::addChild(child, beforeChild);
+    toRenderTableRow(child)->updateBeforeAndAfterContent();
 }
 
 void RenderTableSection::removeChild(RenderObject* oldChild)