Commit 07c23a63 authored by inferno@chromium.org's avatar inferno@chromium.org

2011-01-31 Abhishek Arya <inferno@chromium.org>

        Reviewed by Dimitri Glazkov.

        Check the textarea node still exists in document before casting
        it to HTMLTextAreaElement.
        https://bugs.webkit.org/show_bug.cgi?id=53429

        Test: fast/forms/textarea-node-removed-from-document-crash.html

        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
2011-01-31  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dimitri Glazkov.

        Tests that we do not crash when destructing textarea renderer when its
        node is already removed from document.
        https://bugs.webkit.org/show_bug.cgi?id=53429

        * fast/forms/textarea-node-removed-from-document-crash-expected.txt: Added.
        * fast/forms/textarea-node-removed-from-document-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 8ef074bf
2011-01-31 Abhishek Arya <inferno@chromium.org>
Reviewed by Dimitri Glazkov.
Tests that we do not crash when destructing textarea renderer when its
node is already removed from document.
https://bugs.webkit.org/show_bug.cgi?id=53429
* fast/forms/textarea-node-removed-from-document-crash-expected.txt: Added.
* fast/forms/textarea-node-removed-from-document-crash.html: Added.
2011-01-31 Dan Bernstein <mitz@apple.com> 2011-01-31 Dan Bernstein <mitz@apple.com>
Remove expected results in mac-wk2 and win that are equal to the mac results after r77138. Remove expected results in mac-wk2 and win that are equal to the mac results after r77138.
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">
<script type="text/javascript">
if (window.layoutTestController)
{
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
function runTest()
{
var elements = document.getElementsByTagNameNS('http://www.w3.org/1999/xhtml','html');
elements[0].textContent = "PASS";
if (window.layoutTestController)
layoutTestController.notifyDone();
}
</script>
<xht:object>
<input autofocus="" onfocus="runTest();"/>
<xht:textarea></xht:textarea>
</xht:object>
</html>
2011-01-31 Abhishek Arya <inferno@chromium.org>
Reviewed by Dimitri Glazkov.
Check the textarea node still exists in document before casting
it to HTMLTextAreaElement.
https://bugs.webkit.org/show_bug.cgi?id=53429
Test: fast/forms/textarea-node-removed-from-document-crash.html
* rendering/RenderTextControlMultiLine.cpp:
(WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
2011-01-27 Abhishek Arya <inferno@chromium.org> 2011-01-27 Abhishek Arya <inferno@chromium.org>
Reviewed by Dave Hyatt. Reviewed by Dave Hyatt.
...@@ -38,7 +38,7 @@ RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placehol ...@@ -38,7 +38,7 @@ RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placehol
RenderTextControlMultiLine::~RenderTextControlMultiLine() RenderTextControlMultiLine::~RenderTextControlMultiLine()
{ {
if (node()) if (node() && node()->inDocument())
static_cast<HTMLTextAreaElement*>(node())->rendererWillBeDestroyed(); static_cast<HTMLTextAreaElement*>(node())->rendererWillBeDestroyed();
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment