From e298587600ff28d91fe67863b3128dc1e32fcc31 Mon Sep 17 00:00:00 2001 From: "cfleizach@apple.com" Date: Wed, 17 Mar 2010 00:10:13 +0000 Subject: [PATCH] REGRESSION (r53857): Crash when tabbing to https://bugs.webkit.org/show_bug.cgi?id=36017 Reviewed by Darin Adler. WebCore: Test: fast/events/imagemap-norender-crash.html * html/HTMLMapElement.cpp: (WebCore::HTMLMapElement::imageElement): LayoutTests: Also fix the path to js-test-post.js in tab-imagemap.html. * fast/events/imagemap-norender-crash-expected.txt: Added. * fast/events/imagemap-norender-crash.html: Added. * fast/events/tab-imagemap-expected.txt: * fast/events/tab-imagemap.html: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@56094 268f45cc-cd09-0410-ab3c-d52691b4dbfc --- LayoutTests/ChangeLog | 14 ++++++++ .../imagemap-norender-crash-expected.txt | 13 +++++++ .../fast/events/imagemap-norender-crash.html | 34 +++++++++++++++++++ .../fast/events/tab-imagemap-expected.txt | 3 ++ LayoutTests/fast/events/tab-imagemap.html | 2 +- WebCore/ChangeLog | 12 +++++++ WebCore/html/HTMLMapElement.cpp | 2 +- 7 files changed, 78 insertions(+), 2 deletions(-) create mode 100644 LayoutTests/fast/events/imagemap-norender-crash-expected.txt create mode 100644 LayoutTests/fast/events/imagemap-norender-crash.html diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog index 5fbc4450b5a7..dfb12df7424f 100644 --- a/LayoutTests/ChangeLog +++ b/LayoutTests/ChangeLog @@ -1,3 +1,17 @@ +2010-03-16 Chris Fleizach + + Reviewed by Darin Adler. + + REGRESSION (r53857): Crash when tabbing to + https://bugs.webkit.org/show_bug.cgi?id=36017 + + Also fix the path to js-test-post.js in tab-imagemap.html. + + * fast/events/imagemap-norender-crash-expected.txt: Added. + * fast/events/imagemap-norender-crash.html: Added. + * fast/events/tab-imagemap-expected.txt: + * fast/events/tab-imagemap.html: + 2010-03-16 Kenneth Russell Reviewed by Eric Seidel. diff --git a/LayoutTests/fast/events/imagemap-norender-crash-expected.txt b/LayoutTests/fast/events/imagemap-norender-crash-expected.txt new file mode 100644 index 000000000000..56f434934bc6 --- /dev/null +++ b/LayoutTests/fast/events/imagemap-norender-crash-expected.txt @@ -0,0 +1,13 @@ +start element + + +This tests tabbing to an image map link where the map might not have a renderer won't crash. + +On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". + + +PASS document.activeElement.id is 'area1' +PASS successfullyParsed is true + +TEST COMPLETE + diff --git a/LayoutTests/fast/events/imagemap-norender-crash.html b/LayoutTests/fast/events/imagemap-norender-crash.html new file mode 100644 index 000000000000..7aacdd274f44 --- /dev/null +++ b/LayoutTests/fast/events/imagemap-norender-crash.html @@ -0,0 +1,34 @@ + + + + + + + + + +

+ + +

+ + + + + + diff --git a/LayoutTests/fast/events/tab-imagemap-expected.txt b/LayoutTests/fast/events/tab-imagemap-expected.txt index e2ea63cdee94..97add148abb3 100644 --- a/LayoutTests/fast/events/tab-imagemap-expected.txt +++ b/LayoutTests/fast/events/tab-imagemap-expected.txt @@ -10,4 +10,7 @@ PASS document.activeElement.id is 'area3' PASS document.activeElement.id is 'area5' PASS document.activeElement.id is 'area6' PASS document.activeElement.id == 'area1' || document.activeElement.id == 'body' is true +PASS successfullyParsed is true + +TEST COMPLETE diff --git a/LayoutTests/fast/events/tab-imagemap.html b/LayoutTests/fast/events/tab-imagemap.html index 89e61ae0483f..753676aa70ab 100644 --- a/LayoutTests/fast/events/tab-imagemap.html +++ b/LayoutTests/fast/events/tab-imagemap.html @@ -52,6 +52,6 @@ var successfullyParsed = false; successfullyParsed = true; - + diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog index 8af2ca823efe..6b1d593100db 100644 --- a/WebCore/ChangeLog +++ b/WebCore/ChangeLog @@ -1,3 +1,15 @@ +2010-03-16 Chris Fleizach + + Reviewed by Darin Adler. + + REGRESSION (r53857): Crash when tabbing to + https://bugs.webkit.org/show_bug.cgi?id=36017 + + Test: fast/events/imagemap-norender-crash.html + + * html/HTMLMapElement.cpp: + (WebCore::HTMLMapElement::imageElement): + 2010-03-16 Brent Fulgham Build fix. No Review. diff --git a/WebCore/html/HTMLMapElement.cpp b/WebCore/html/HTMLMapElement.cpp index 9617afc7c4d5..10a05d6c7b0d 100644 --- a/WebCore/html/HTMLMapElement.cpp +++ b/WebCore/html/HTMLMapElement.cpp @@ -79,7 +79,7 @@ bool HTMLMapElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestRes HTMLImageElement* HTMLMapElement::imageElement() const { - RefPtr coll = renderer()->document()->images(); + RefPtr coll = document()->images(); for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) { if (!curr->hasTagName(imgTag)) continue; -- 2.36.0