https://bugs.webkit.org/show_bug.cgi?id=36017
Reviewed by Darin Adler.
WebCore:
Test: fast/events/imagemap-norender-crash.html
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::imageElement):
LayoutTests:
Also fix the path to js-test-post.js in tab-imagemap.html.
* fast/events/imagemap-norender-crash-expected.txt: Added.
* fast/events/imagemap-norender-crash.html: Added.
* fast/events/tab-imagemap-expected.txt:
* fast/events/tab-imagemap.html:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@56094
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2010-03-16 Chris Fleizach <cfleizach@apple.com>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION (r53857): Crash when tabbing to <map>
+ https://bugs.webkit.org/show_bug.cgi?id=36017
+
+ Also fix the path to js-test-post.js in tab-imagemap.html.
+
+ * fast/events/imagemap-norender-crash-expected.txt: Added.
+ * fast/events/imagemap-norender-crash.html: Added.
+ * fast/events/tab-imagemap-expected.txt:
+ * fast/events/tab-imagemap.html:
+
2010-03-16 Kenneth Russell <kbr@google.com>
Reviewed by Eric Seidel.
--- /dev/null
+start element
+
+
+This tests tabbing to an image map link where the map might not have a renderer won't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.activeElement.id is 'area1'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- /dev/null
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../js/resources/js-test-style.css">
+<script>
+var successfullyParsed = false;
+</script>
+<script src="../js/resources/js-test-pre.js"></script>
+<body id="body">
+
+<h1 id="header" tabindex=0>start element</h1>
+<div><img src="resources/abe.png" alt="test" style="width:679px; height:112px" usemap="#Map"></div>
+<div style="display:none"><map name="Map" id="Map"><area shape="rect" coords=coords="5,48,247,97" href="http://www.webkit.org/" target="_blank" id="area1"/></map></div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+ description("This tests tabbing to an image map link where the map might not have a renderer won't crash.");
+
+ // start at the right place
+ document.getElementById("header").focus();
+
+ // tab forward
+ eventSender.keyDown('\t');
+ shouldBe("document.activeElement.id", "'area1'");
+
+ successfullyParsed = true;
+</script>
+
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
PASS document.activeElement.id is 'area5'
PASS document.activeElement.id is 'area6'
PASS document.activeElement.id == 'area1' || document.activeElement.id == 'body' is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
successfullyParsed = true;
</script>
-<script src="../fast/js/resources/js-test-post.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
</body>
</html>
+2010-03-16 Chris Fleizach <cfleizach@apple.com>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION (r53857): Crash when tabbing to <map>
+ https://bugs.webkit.org/show_bug.cgi?id=36017
+
+ Test: fast/events/imagemap-norender-crash.html
+
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::imageElement):
+
2010-03-16 Brent Fulgham <bfulgham@webkit.org>
Build fix. No Review.
HTMLImageElement* HTMLMapElement::imageElement() const
{
- RefPtr<HTMLCollection> coll = renderer()->document()->images();
+ RefPtr<HTMLCollection> coll = document()->images();
for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
if (!curr->hasTagName(imgTag))
continue;