Title: [115763] trunk
- Revision
- 115763
- Author
- [email protected]
- Date
- 2012-05-01 17:04:01 -0700 (Tue, 01 May 2012)
Log Message
Ensure HTMLElementStack fails gracefully if it has a non-Element.
https://bugs.webkit.org/show_bug.cgi?id=85167
Reviewed by Adam Barth.
Source/WebCore:
Test: Added to html5lib/resources/webkit02.dat
* html/parser/HTMLElementStack.cpp:
(WebCore::HTMLElementStack::oneBelowTop):
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processEndTag):
LayoutTests:
* html5lib/resources/webkit02.dat:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (115762 => 115763)
--- trunk/LayoutTests/ChangeLog 2012-05-01 23:45:55 UTC (rev 115762)
+++ trunk/LayoutTests/ChangeLog 2012-05-02 00:04:01 UTC (rev 115763)
@@ -1,3 +1,12 @@
+2012-05-01 James Simonsen <[email protected]>
+
+ Ensure HTMLElementStack fails gracefully if it has a non-Element.
+ https://bugs.webkit.org/show_bug.cgi?id=85167
+
+ Reviewed by Adam Barth.
+
+ * html5lib/resources/webkit02.dat:
+
2012-05-01 Christophe Dumez <[email protected]>
[EFL] fast/loader/file-protocol-fragment.html needs rebaselining
Modified: trunk/LayoutTests/html5lib/resources/webkit02.dat (115762 => 115763)
--- trunk/LayoutTests/html5lib/resources/webkit02.dat 2012-05-01 23:45:55 UTC (rev 115762)
+++ trunk/LayoutTests/html5lib/resources/webkit02.dat 2012-05-02 00:04:01 UTC (rev 115763)
@@ -149,3 +149,11 @@
| <input>
| name="isindex"
| <hr>
+
+#data
+<option><XH<optgroup></optgroup>
+#errors
+#document-fragment
+select
+#document
+| <option>
Modified: trunk/Source/WebCore/ChangeLog (115762 => 115763)
--- trunk/Source/WebCore/ChangeLog 2012-05-01 23:45:55 UTC (rev 115762)
+++ trunk/Source/WebCore/ChangeLog 2012-05-02 00:04:01 UTC (rev 115763)
@@ -1,3 +1,17 @@
+2012-05-01 James Simonsen <[email protected]>
+
+ Ensure HTMLElementStack fails gracefully if it has a non-Element.
+ https://bugs.webkit.org/show_bug.cgi?id=85167
+
+ Reviewed by Adam Barth.
+
+ Test: Added to html5lib/resources/webkit02.dat
+
+ * html/parser/HTMLElementStack.cpp:
+ (WebCore::HTMLElementStack::oneBelowTop):
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processEndTag):
+
2012-05-01 Ryosuke Niwa <[email protected]>
*Command.h files shouldn't be exported to WebKit layer
Modified: trunk/Source/WebCore/html/parser/HTMLElementStack.cpp (115762 => 115763)
--- trunk/Source/WebCore/html/parser/HTMLElementStack.cpp 2012-05-01 23:45:55 UTC (rev 115762)
+++ trunk/Source/WebCore/html/parser/HTMLElementStack.cpp 2012-05-02 00:04:01 UTC (rev 115763)
@@ -386,10 +386,12 @@
Element* HTMLElementStack::oneBelowTop() const
{
- // We should never be calling this if it could be 0.
+ // We should never call this if there are fewer than 2 elements on the stack.
ASSERT(m_top);
ASSERT(m_top->next());
- return m_top->next()->element();
+ if (m_top->next()->node()->isElementNode())
+ return m_top->next()->element();
+ return 0;
}
Element* HTMLElementStack::bottom() const
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (115762 => 115763)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-05-01 23:45:55 UTC (rev 115762)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-05-02 00:04:01 UTC (rev 115763)
@@ -2193,7 +2193,7 @@
case InSelectMode:
ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode);
if (token.name() == optgroupTag) {
- if (m_tree.currentNode()->hasTagName(optionTag) && m_tree.oneBelowTop()->hasTagName(optgroupTag))
+ if (m_tree.currentNode()->hasTagName(optionTag) && m_tree.oneBelowTop() && m_tree.oneBelowTop()->hasTagName(optgroupTag))
processFakeEndTag(optionTag);
if (m_tree.currentNode()->hasTagName(optgroupTag)) {
m_tree.openElements()->pop();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
