Commit ef3259eb authored by inferno@chromium.org's avatar inferno@chromium.org

2011-01-27 Abhishek Arya <inferno@chromium.org>

        Reviewed by Dave Hyatt.

        Tests that we do not crash when adding a child in a table
        where the before child is not a table section.
        https://bugs.webkit.org/show_bug.cgi?id=53276

        * fast/table/before-child-non-table-section-add-table-crash-expected.txt: Added.
        * fast/table/before-child-non-table-section-add-table-crash.html: Added.
2011-01-27  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dave Hyatt.

        If beforeChild is wrapped in an anonymous table section, we need to
        go the parent to find it and use it before adding childs to table.
        https://bugs.webkit.org/show_bug.cgi?id=53276

        We need to make sure that beforeChild's parent is "this" before calling
        RenderBox::addChild. The previous condition in while is too restrictive
        and fails to calculate the right beforeChild value when its display
        style is table caption.
        Test: fast/table/before-child-non-table-section-add-table-crash.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 4ef89be4
2011-01-27 Abhishek Arya <inferno@chromium.org>
Reviewed by Dave Hyatt.
Tests that we do not crash when adding a child in a table
where the before child is not a table section.
https://bugs.webkit.org/show_bug.cgi?id=53276
* fast/table/before-child-non-table-section-add-table-crash-expected.txt: Added.
* fast/table/before-child-non-table-section-add-table-crash.html: Added.
2011-01-31 Tony Chang <tony@chromium.org>
Reviewed by Eric Seidel.
<html>
<body onload="runTest();">
<div id="table" style="display: table;">
<em id="em"></em>
<audio controls="arbitrary" style="display: table-caption;" />
<img id="img" />
</div>
<div id="result"></div>
<script type="text/javascript">
if (window.layoutTestController)
layoutTestController.dumpAsText();
function runTest()
{
var img = document.getElementById('img');
var em = document.getElementById('em');
em.parentNode.replaceChild(img, em);
document.body.offsetTop;
document.body.removeChild(document.getElementById('table'));
document.getElementById("result").innerHTML = "PASS";
}
</script>
</body>
</html>
2011-01-27 Abhishek Arya <inferno@chromium.org>
Reviewed by Dave Hyatt.
If beforeChild is wrapped in an anonymous table section, we need to
go the parent to find it and use it before adding childs to table.
https://bugs.webkit.org/show_bug.cgi?id=53276
We need to make sure that beforeChild's parent is "this" before calling
RenderBox::addChild. The previous condition in while is too restrictive
and fails to calculate the right beforeChild value when its display
style is table caption.
Test: fast/table/before-child-non-table-section-add-table-crash.html
* rendering/RenderTable.cpp:
(WebCore::RenderTable::addChild):
2011-01-31 Shane Stephens <shanestephens@google.com>
Reviewed by Simon Fraser.
......@@ -162,7 +162,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
if (!wrapInAnonymousSection) {
// If the next renderer is actually wrapped in an anonymous table section, we need to go up and find that.
while (beforeChild && !beforeChild->isTableSection() && !beforeChild->isTableCol() && beforeChild->style()->display() != TABLE_CAPTION)
while (beforeChild && beforeChild->parent() != this)
beforeChild = beforeChild->parent();
RenderBox::addChild(child, beforeChild);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment