Title: [89780] trunk
- Revision
- 89780
- Author
- [email protected]
- Date
- 2011-06-26 20:43:39 -0700 (Sun, 26 Jun 2011)
Log Message
2011-06-26 Adam Barth <[email protected]>
Reviewed by Kent Tamura.
m_formElementsWithFormAttribute doesn't ref the objects it holds
https://bugs.webkit.org/show_bug.cgi?id=62956
* fast/forms/form-associated-element-crash3-expected.txt: Added.
* fast/forms/form-associated-element-crash3.html: Added.
2011-06-26 Adam Barth <[email protected]>
Reviewed by Kent Tamura.
m_formElementsWithFormAttribute doesn't ref the objects it holds
https://bugs.webkit.org/show_bug.cgi?id=62956
Test: fast/forms/form-associated-element-crash3.html
* dom/Document.h:
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (89779 => 89780)
--- trunk/LayoutTests/ChangeLog 2011-06-27 03:34:31 UTC (rev 89779)
+++ trunk/LayoutTests/ChangeLog 2011-06-27 03:43:39 UTC (rev 89780)
@@ -1,5 +1,15 @@
2011-06-26 Adam Barth <[email protected]>
+ Reviewed by Kent Tamura.
+
+ m_formElementsWithFormAttribute doesn't ref the objects it holds
+ https://bugs.webkit.org/show_bug.cgi?id=62956
+
+ * fast/forms/form-associated-element-crash3-expected.txt: Added.
+ * fast/forms/form-associated-element-crash3.html: Added.
+
+2011-06-26 Adam Barth <[email protected]>
+
Baselines for new test.
* platform/chromium-linux/fast/text/midword-break-before-surrogate-pair-expected.png: Added.
Added: trunk/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt (0 => 89780)
--- trunk/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt 2011-06-27 03:43:39 UTC (rev 89780)
@@ -0,0 +1 @@
+This test passes if it doesn't crash. Note: You might need to reload this test many times (or run the test under valgrind / ASAN) to see a crash.
Added: trunk/LayoutTests/fast/forms/form-associated-element-crash3.html (0 => 89780)
--- trunk/LayoutTests/fast/forms/form-associated-element-crash3.html (rev 0)
+++ trunk/LayoutTests/fast/forms/form-associated-element-crash3.html 2011-06-27 03:43:39 UTC (rev 89780)
@@ -0,0 +1,16 @@
+<body>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash. Note: You might need to reload this test
+many times (or run the test under valgrind / ASAN) to see a crash.
+<span>
+<span>
+<video src="" onloadstart>
+<form id="tjbvp"></form>
+</video>
+</span>
+</span>
+<keygen form="woujt">
+</body>
Modified: trunk/Source/WebCore/ChangeLog (89779 => 89780)
--- trunk/Source/WebCore/ChangeLog 2011-06-27 03:34:31 UTC (rev 89779)
+++ trunk/Source/WebCore/ChangeLog 2011-06-27 03:43:39 UTC (rev 89780)
@@ -1,3 +1,14 @@
+2011-06-26 Adam Barth <[email protected]>
+
+ Reviewed by Kent Tamura.
+
+ m_formElementsWithFormAttribute doesn't ref the objects it holds
+ https://bugs.webkit.org/show_bug.cgi?id=62956
+
+ Test: fast/forms/form-associated-element-crash3.html
+
+ * dom/Document.h:
+
2011-06-26 Dimitri Glazkov <[email protected]>
Reviewed by Adam Barth.
Modified: trunk/Source/WebCore/dom/Document.h (89779 => 89780)
--- trunk/Source/WebCore/dom/Document.h 2011-06-27 03:34:31 UTC (rev 89779)
+++ trunk/Source/WebCore/dom/Document.h 2011-06-27 03:43:39 UTC (rev 89780)
@@ -1226,7 +1226,7 @@
typedef ListHashSet<Element*, 64> FormElementListHashSet;
FormElementListHashSet m_formElementsWithState;
- typedef ListHashSet<FormAssociatedElement*, 32> FormAssociatedElementListHashSet;
+ typedef ListHashSet<RefPtr<FormAssociatedElement>, 32> FormAssociatedElementListHashSet;
FormAssociatedElementListHashSet m_formElementsWithFormAttribute;
typedef HashMap<FormElementKey, Vector<String>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
