Title: [133220] branches/safari-536.28-branch
- Revision
- 133220
- Author
- lforsch...@apple.com
- Date
- 2012-11-01 13:35:00 -0700 (Thu, 01 Nov 2012)
Log Message
Merged r123128. <rdar://problem/12536420>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133219 => 133220)
--- branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-01 20:30:15 UTC (rev 133219)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-01 20:35:00 UTC (rev 133220)
@@ -1,5 +1,19 @@
2012-10-31 Lucas Forschler <lforsch...@apple.com>
+ Merge r123128
+
+ 2012-07-19 Douglas Stockwell <dstockw...@google.com>
+
+ Crash in WebCore::StyleResolver::collectMatchingRulesForList
+ https://bugs.webkit.org/show_bug.cgi?id=90803
+
+ Reviewed by Andreas Kling.
+
+ * fast/css/xml-stylesheet-removed-expected.txt: Added.
+ * fast/css/xml-stylesheet-removed.xhtml: Added.
+
+2012-10-31 Lucas Forschler <lforsch...@apple.com>
+
Merge r123062
2012-07-18 Julien Chaffraix <jchaffr...@webkit.org>
@@ -10603,3 +10617,4 @@
.
.
.
+.
Copied: branches/safari-536.28-branch/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt (from rev 123128, trunk/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt) (0 => 133220)
--- branches/safari-536.28-branch/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/css/xml-stylesheet-removed-expected.txt 2012-11-01 20:35:00 UTC (rev 133220)
@@ -0,0 +1 @@
+PASS
Copied: branches/safari-536.28-branch/LayoutTests/fast/css/xml-stylesheet-removed.xhtml (from rev 123128, trunk/LayoutTests/fast/css/xml-stylesheet-removed.xhtml) (0 => 133220)
--- branches/safari-536.28-branch/LayoutTests/fast/css/xml-stylesheet-removed.xhtml (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/css/xml-stylesheet-removed.xhtml 2012-11-01 20:35:00 UTC (rev 133220)
@@ -0,0 +1,18 @@
+<?xml-stylesheet href="" title="style" type="text/css"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<div id="result">FAIL</div>
+<script type="text/_javascript_">
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+_onload_ = function() {
+ document.documentElement.appendChild(document.styleSheets[0].ownerNode);
+ // Note: xml stylesheet is only valid when its parent is the document
+ if (document.styleSheets.length == 0)
+ document.getElementById('result').innerText = 'PASS';
+ if (window.testRunner)
+ testRunner.notifyDone();
+};
+</script>
+</html>
Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133219 => 133220)
--- branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-01 20:30:15 UTC (rev 133219)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-01 20:35:00 UTC (rev 133220)
@@ -1,5 +1,28 @@
2012-10-31 Lucas Forschler <lforsch...@apple.com>
+ Merge r123128
+
+ 2012-07-19 Douglas Stockwell <dstockw...@google.com>
+
+ Crash in WebCore::StyleResolver::collectMatchingRulesForList
+ https://bugs.webkit.org/show_bug.cgi?id=90803
+
+ Reviewed by Andreas Kling.
+
+ When a ProcessingInstruction was removed from the document the owner
+ was removed, but the style resolver was not guaranteed to be updated.
+ It was then possible for an inconsistent version of the stylesheet to
+ remain visible in the DOM. Fixed by removing an invalid condition and
+ mirroring the logic from StyleElement.
+
+ Test: fast/css/xml-stylesheet-removed.xhtml
+
+ * dom/ProcessingInstruction.cpp:
+ (WebCore::ProcessingInstruction::removedFrom): Mirror the logic from
+ StyleElement -- always update the style resolver.
+
+2012-10-31 Lucas Forschler <lforsch...@apple.com>
+
Merge r123062
2012-07-18 Julien Chaffraix <jchaffr...@webkit.org>
@@ -205807,3 +205830,4 @@
.
.
.
+.
Modified: branches/safari-536.28-branch/Source/WebCore/dom/ProcessingInstruction.cpp (133219 => 133220)
--- branches/safari-536.28-branch/Source/WebCore/dom/ProcessingInstruction.cpp 2012-11-01 20:30:15 UTC (rev 133219)
+++ branches/safari-536.28-branch/Source/WebCore/dom/ProcessingInstruction.cpp 2012-11-01 20:35:00 UTC (rev 133220)
@@ -311,7 +311,8 @@
m_sheet = 0;
}
- if (m_cachedSheet)
+ // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
+ if (document()->renderer())
document()->styleResolverChanged(DeferRecalcStyle);
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
