diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog index c63d80956c2a1da35c8141b02e3f6f163ebb55cc..cb1baedcf4b3ca81f9381a96c5f62d28f1389fa3 100644 --- a/LayoutTests/ChangeLog +++ b/LayoutTests/ChangeLog @@ -1,3 +1,14 @@ +2011-01-31 Abhishek Arya + + Reviewed by Dimitri Glazkov. + + Tests that we do not crash when destructing textarea renderer when its + node is already removed from document. + https://bugs.webkit.org/show_bug.cgi?id=53429 + + * fast/forms/textarea-node-removed-from-document-crash-expected.txt: Added. + * fast/forms/textarea-node-removed-from-document-crash.html: Added. + 2011-01-31 Dan Bernstein Remove expected results in mac-wk2 and win that are equal to the mac results after r77138. diff --git a/LayoutTests/fast/forms/textarea-node-removed-from-document-crash-expected.txt b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash-expected.txt new file mode 100644 index 0000000000000000000000000000000000000000..7ef22e9a431ad0272713b71fdc8794016c8ef12f --- /dev/null +++ b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash-expected.txt @@ -0,0 +1 @@ +PASS diff --git a/LayoutTests/fast/forms/textarea-node-removed-from-document-crash.html b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash.html new file mode 100644 index 0000000000000000000000000000000000000000..32f58425fc9837021c6bf6862926bcd8079aabd0 --- /dev/null +++ b/LayoutTests/fast/forms/textarea-node-removed-from-document-crash.html @@ -0,0 +1,23 @@ + + + + + + + + diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog index 61c2110ed5db8fc7021421de62872e8c00caf04e..4322aa292471a2bc46a349d74ff892c98c1dacab 100644 --- a/Source/WebCore/ChangeLog +++ b/Source/WebCore/ChangeLog @@ -1,3 +1,16 @@ +2011-01-31 Abhishek Arya + + Reviewed by Dimitri Glazkov. + + Check the textarea node still exists in document before casting + it to HTMLTextAreaElement. + https://bugs.webkit.org/show_bug.cgi?id=53429 + + Test: fast/forms/textarea-node-removed-from-document-crash.html + + * rendering/RenderTextControlMultiLine.cpp: + (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine): + 2011-01-27 Abhishek Arya Reviewed by Dave Hyatt. diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp index 3e3ad41f72bd8d976bae555d14b5f530ec196dc9..0d512f3621007fc5756ae1615a9d16aaad7e3d6f 100644 --- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp +++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp @@ -38,7 +38,7 @@ RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placehol RenderTextControlMultiLine::~RenderTextControlMultiLine() { - if (node()) + if (node() && node()->inDocument()) static_cast(node())->rendererWillBeDestroyed(); }