git://git.webkit.org / WebKit.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 11dc396)
REGRESSION (r53857): Crash when tabbing to <map>
authorcfleizach@apple.com <cfleizach@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Mar 2010 00:10:13 +0000 (00:10 +0000)
committercfleizach@apple.com <cfleizach@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Mar 2010 00:10:13 +0000 (00:10 +0000)
https://bugs.webkit.org/show_bug.cgi?id=36017

Reviewed by Darin Adler.

WebCore:

Test: fast/events/imagemap-norender-crash.html

* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::imageElement):

LayoutTests:

Also fix the path to js-test-post.js in tab-imagemap.html.

* fast/events/imagemap-norender-crash-expected.txt: Added.
* fast/events/imagemap-norender-crash.html: Added.
* fast/events/tab-imagemap-expected.txt:
* fast/events/tab-imagemap.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@56094 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/events/imagemap-norender-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/events/imagemap-norender-crash.html [new file with mode: 0644] patch | blob
LayoutTests/fast/events/tab-imagemap-expected.txt patch | blob | history
LayoutTests/fast/events/tab-imagemap.html patch | blob | history
WebCore/ChangeLog patch | blob | history
WebCore/html/HTMLMapElement.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 5fbc4450b5a7e8d70156234731c734c3488a36ab..dfb12df7424fba742d45ae71534af52bb08d29b6 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2010-03-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r53857): Crash when tabbing to <map>
+        https://bugs.webkit.org/show_bug.cgi?id=36017
+
+        Also fix the path to js-test-post.js in tab-imagemap.html.
+
+        * fast/events/imagemap-norender-crash-expected.txt: Added.
+        * fast/events/imagemap-norender-crash.html: Added.
+        * fast/events/tab-imagemap-expected.txt:
+        * fast/events/tab-imagemap.html:
+
 2010-03-16  Kenneth Russell  <kbr@google.com>
 
         Reviewed by Eric Seidel.
diff --git a/LayoutTests/fast/events/imagemap-norender-crash-expected.txt b/LayoutTests/fast/events/imagemap-norender-crash-expected.txt
new file mode 100644 (file)
index 0000000..56f4349
--- /dev/null
+++ b/LayoutTests/fast/events/imagemap-norender-crash-expected.txt
@@ -0,0 +1,13 @@
+start element
+
+
+This tests tabbing to an image map link where the map might not have a renderer won't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.activeElement.id is 'area1'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/events/imagemap-norender-crash.html b/LayoutTests/fast/events/imagemap-norender-crash.html
new file mode 100644 (file)
index 0000000..7aacdd2
--- /dev/null
+++ b/LayoutTests/fast/events/imagemap-norender-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../js/resources/js-test-style.css">
+<script>
+var successfullyParsed = false;
+</script>
+<script src="../js/resources/js-test-pre.js"></script>
+<body id="body">
+
+<h1 id="header" tabindex=0>start element</h1>
+<div><img src="resources/abe.png" alt="test" style="width:679px; height:112px" usemap="#Map"></div>
+<div style="display:none"><map name="Map" id="Map"><area shape="rect" coords=coords="5,48,247,97" href="http://www.webkit.org/" target="_blank" id="area1"/></map></div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests tabbing to an image map link where the map might not have a renderer won't crash.");
+
+    // start at the right place
+    document.getElementById("header").focus();
+
+    // tab forward
+    eventSender.keyDown('\t');
+    shouldBe("document.activeElement.id", "'area1'");
+
+    successfullyParsed = true;
+</script>
+
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/events/tab-imagemap-expected.txt b/LayoutTests/fast/events/tab-imagemap-expected.txt
index e2ea63cdee941a907312687d45cb7e5c2491b1de..97add148abb3df01eb8dfed4a9f283a5434689bb 100644 (file)
--- a/LayoutTests/fast/events/tab-imagemap-expected.txt
+++ b/LayoutTests/fast/events/tab-imagemap-expected.txt
@@ -10,4 +10,7 @@ PASS document.activeElement.id is 'area3'
 PASS document.activeElement.id is 'area5'
 PASS document.activeElement.id is 'area6'
 PASS document.activeElement.id == 'area1' || document.activeElement.id == 'body' is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
 
diff --git a/LayoutTests/fast/events/tab-imagemap.html b/LayoutTests/fast/events/tab-imagemap.html
index 89e61ae0483fa4acf710df401824d39aab5fa803..753676aa70ab50d9378d99cef275c23ee07d92db 100644 (file)
--- a/LayoutTests/fast/events/tab-imagemap.html
+++ b/LayoutTests/fast/events/tab-imagemap.html
@@ -52,6 +52,6 @@ var successfullyParsed = false;
     successfullyParsed = true;
 </script>
 
-<script src="../fast/js/resources/js-test-post.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
 </body>
 </html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8af2ca823efe5c151bff1067904c15b0a4af96fe..6b1d593100dbc868ebee3467e3cb124d63cc7ea2 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-03-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r53857): Crash when tabbing to <map>
+        https://bugs.webkit.org/show_bug.cgi?id=36017
+
+        Test: fast/events/imagemap-norender-crash.html
+
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
+
 2010-03-16  Brent Fulgham  <bfulgham@webkit.org>
 
         Build fix.  No Review.
diff --git a/WebCore/html/HTMLMapElement.cpp b/WebCore/html/HTMLMapElement.cpp
index 9617afc7c4d5ee076d6f4f35b6aeb1fe07cb8c60..10a05d6c7b0d5560b5cd687189ab65722eefdb27 100644 (file)
--- a/WebCore/html/HTMLMapElement.cpp
+++ b/WebCore/html/HTMLMapElement.cpp
@@ -79,7 +79,7 @@ bool HTMLMapElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestRes
 
 HTMLImageElement* HTMLMapElement::imageElement() const
 {
-    RefPtr<HTMLCollection> coll = renderer()->document()->images();
+    RefPtr<HTMLCollection> coll = document()->images();
     for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
         if (!curr->hasTagName(imgTag))
             continue;
Mirror of the WebKit open source project on svn.webkit.org.