Title: [118033] branches/chromium/1132
- Revision
- 118033
- Author
- [email protected]
- Date
- 2012-05-22 13:15:19 -0700 (Tue, 22 May 2012)
Log Message
Merge 116864
BUG=126040
Review URL: https://chromiumcodereview.appspot.com/10411076
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt (from rev 116864, trunk/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt) (0 => 118033)
--- branches/chromium/1132/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash-expected.txt 2012-05-22 20:15:19 UTC (rev 118033)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS. WebKit didn't crash.
Copied: branches/chromium/1132/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html (from rev 116864, trunk/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html) (0 => 118033)
--- branches/chromium/1132/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/dom/HTMLSelectElement/option-add-crash.html 2012-05-22 20:15:19 UTC (rev 118033)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<script src=""
+<script>
+function crash()
+{
+ try {
+ document.getElementsByTagName('option')[0].parentNode.removeChild(document.getElementsByTagName('option')[0]);
+ } catch (Exception) {}
+
+ gc();
+}
+document.write("PASS. WebKit didn't crash.<select></select>");
+var select1 = document.getElementsByTagName('select')[0];
+select1.appendChild(document.createElement('option'));
+select1.appendChild(document.createElement('option'));
+document.addEventListener("DOMSubtreeModified", crash, false);
+try {
+ select1.options[0] = new Option("", "");
+} catch (Exception) { }
+</script>
+<script src=""
+</html>
Modified: branches/chromium/1132/Source/WebCore/html/HTMLSelectElement.cpp (118032 => 118033)
--- branches/chromium/1132/Source/WebCore/html/HTMLSelectElement.cpp 2012-05-22 20:14:08 UTC (rev 118032)
+++ branches/chromium/1132/Source/WebCore/html/HTMLSelectElement.cpp 2012-05-22 20:15:19 UTC (rev 118033)
@@ -413,7 +413,7 @@
if (index > maxSelectItems - 1)
index = maxSelectItems - 1;
int diff = index - length();
- HTMLElement* before = 0;
+ RefPtr<HTMLElement> before = 0;
// Out of array bounds? First insert empty dummies.
if (diff > 0) {
setLength(index, ec);
@@ -424,7 +424,7 @@
}
// Finally add the new element.
if (!ec) {
- add(option, before, ec);
+ add(option, before.get(), ec);
if (diff >= 0 && option->selected())
optionSelectionStateChanged(option, true);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
