Commit c58da5f9 authored by eric@webkit.org's avatar eric@webkit.org

Reviewed by Adam Roben.

        Fix mappedAttributes() access without NULL check
        https://bugs.webkit.org/show_bug.cgi?id=25553

        SVGStyledElement::getPresentationAttribute was using mappedAttributes()
        without checking for NULL.

        HTMLInputElement::setInputType also doesn't NULL check, but I was not
        able to get it to crash with a test case so I just added an ASSERT.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setInputType):
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::getPresentationAttribute):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 7fd25f4a
2009-05-05 Eric Seidel <eric@webkit.org>
Reviewed by Adam Roben.
Fix mappedAttributes() access without NULL check
https://bugs.webkit.org/show_bug.cgi?id=25553
* svg/custom/path-getPresentationAttribute-crash-expected.txt: Added.
* svg/custom/path-getPresentationAttribute-crash.html: Added.
2009-05-04 Eric Seidel <eric@webkit.org>
Reviewed by Maciej Stachowiak.
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
var path = document.createElementNS("http://www.w3.org/2000/svg", "path");
path.getPresentationAttribute("");
document.write("PASSED -- WebKit did not crash!");
</script>
2009-05-05 Eric Seidel <eric@webkit.org>
Reviewed by Adam Roben.
Fix mappedAttributes() access without NULL check
https://bugs.webkit.org/show_bug.cgi?id=25553
SVGStyledElement::getPresentationAttribute was using mappedAttributes()
without checking for NULL.
HTMLInputElement::setInputType also doesn't NULL check, but I was not
able to get it to crash with a test case so I just added an ASSERT.
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setInputType):
* svg/SVGStyledElement.cpp:
(WebCore::SVGStyledElement::getPresentationAttribute):
2009-05-05 Holger Hans Peter Freyther <zecke@selfish.org>
Reviewed by Xan Lopez.
......@@ -275,6 +275,7 @@ void HTMLInputElement::setInputType(const String& t)
if (didRespectHeightAndWidth != willRespectHeightAndWidth) {
NamedMappedAttrMap* map = mappedAttributes();
ASSERT(map);
if (Attribute* height = map->getAttributeItem(heightAttr))
attributeChanged(height, false);
if (Attribute* width = map->getAttributeItem(widthAttr))
......
......@@ -242,6 +242,9 @@ PassRefPtr<RenderStyle> SVGStyledElement::resolveStyle(RenderStyle* parentStyle)
PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& name)
{
if (!mappedAttributes())
return 0;
Attribute* attr = mappedAttributes()->getAttributeItem(QualifiedName(nullAtom, name, nullAtom));
if (!attr || !attr->isMappedAttribute() || !attr->style())
return 0;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment