Title: [180698] branches/safari-600.1.4.15-branch
- Revision
- 180698
- Author
- lforsch...@apple.com
- Date
- 2015-02-26 14:18:10 -0800 (Thu, 26 Feb 2015)
Log Message
Merged r180174. rdar://problem/19966344
Modified Paths
Added Paths
Diff
Modified: branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog (180697 => 180698)
--- branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog 2015-02-26 22:04:13 UTC (rev 180697)
+++ branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog 2015-02-26 22:18:10 UTC (rev 180698)
@@ -1,3 +1,21 @@
+2015-02-26 Lucas Forschler <lforsch...@apple.com>
+
+ Merge r180174
+
+ 2015-02-16 Zalan Bujtas <za...@apple.com>
+
+ RenderTableCell can't access its parent while in detached state.
+ https://bugs.webkit.org/show_bug.cgi?id=141639
+ rdar://problem/19850760
+
+ Reviewed by Simon Fraser.
+
+ Null check against ancestor chain so that certain methods in RenderTableCell can
+ be called even if the renderer is not yet attached.
+
+ * fast/table/table-cell-crash-when-detached-state-expected.txt: Added.
+ * fast/table/table-cell-crash-when-detached-state.html: Added.
+
2015-02-25 Babak Shafiei <bshaf...@apple.com>
Merge r180274.
Copied: branches/safari-600.1.4.15-branch/LayoutTests/fast/table/table-cell-crash-when-detached-state-expected.txt (from rev 180174, trunk/LayoutTests/fast/table/table-cell-crash-when-detached-state-expected.txt) (0 => 180698)
--- branches/safari-600.1.4.15-branch/LayoutTests/fast/table/table-cell-crash-when-detached-state-expected.txt (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/fast/table/table-cell-crash-when-detached-state-expected.txt 2015-02-26 22:18:10 UTC (rev 180698)
@@ -0,0 +1 @@
+Pass if no crash or assert in debug.
Copied: branches/safari-600.1.4.15-branch/LayoutTests/fast/table/table-cell-crash-when-detached-state.html (from rev 180174, trunk/LayoutTests/fast/table/table-cell-crash-when-detached-state.html) (0 => 180698)
--- branches/safari-600.1.4.15-branch/LayoutTests/fast/table/table-cell-crash-when-detached-state.html (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/fast/table/table-cell-crash-when-detached-state.html 2015-02-26 22:18:10 UTC (rev 180698)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests table cell can survive width/height related calls while it is in detached state.</title>
+<style>
+ h1 {
+ display: table-cell !important;
+ background-clip: padding-box;
+ -webkit-transform: rotateX(0deg);
+ }
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+Pass if no crash or assert in debug.
+<h1></h1>
+</body>
+</html>
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog (180697 => 180698)
--- branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog 2015-02-26 22:04:13 UTC (rev 180697)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog 2015-02-26 22:18:10 UTC (rev 180698)
@@ -1,5 +1,33 @@
2015-02-26 Lucas Forschler <lforsch...@apple.com>
+ Merge r180174
+
+ 2015-02-16 Zalan Bujtas <za...@apple.com>
+
+ RenderTableCell can't access its parent while in detached state.
+ https://bugs.webkit.org/show_bug.cgi?id=141639
+ rdar://problem/19850760
+
+ Reviewed by Simon Fraser.
+
+ Null check against ancestor chain so that certain methods in RenderTableCell can
+ be called even if the renderer is not yet attached.
+
+ Test: fast/table/table-cell-crash-when-detached-state.html
+
+ * rendering/RenderTableCell.cpp:
+ (WebCore::RenderTableCell::borderLeft):
+ (WebCore::RenderTableCell::borderRight):
+ (WebCore::RenderTableCell::borderTop):
+ (WebCore::RenderTableCell::borderBottom):
+ (WebCore::RenderTableCell::borderStart):
+ (WebCore::RenderTableCell::borderEnd):
+ (WebCore::RenderTableCell::borderBefore):
+ (WebCore::RenderTableCell::borderAfter):
+ * rendering/RenderTableCell.h:
+
+2015-02-26 Lucas Forschler <lforsch...@apple.com>
+
Merge r179480
2015-02-02 Jeremy Jones <jere...@apple.com>
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderTableCell.cpp (180697 => 180698)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderTableCell.cpp 2015-02-26 22:04:13 UTC (rev 180697)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderTableCell.cpp 2015-02-26 22:18:10 UTC (rev 180698)
@@ -932,44 +932,68 @@
LayoutUnit RenderTableCell::borderLeft() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfLeft(false)) : RenderBlockFlow::borderLeft();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderLeft();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfLeft(false)) : RenderBlockFlow::borderLeft();
}
LayoutUnit RenderTableCell::borderRight() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfRight(false)) : RenderBlockFlow::borderRight();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderRight();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfRight(false)) : RenderBlockFlow::borderRight();
}
LayoutUnit RenderTableCell::borderTop() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfTop(false)) : RenderBlockFlow::borderTop();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderTop();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfTop(false)) : RenderBlockFlow::borderTop();
}
LayoutUnit RenderTableCell::borderBottom() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfBottom(false)) : RenderBlockFlow::borderBottom();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderBottom();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfBottom(false)) : RenderBlockFlow::borderBottom();
}
// FIXME: https://bugs.webkit.org/show_bug.cgi?id=46191, make the collapsed border drawing
// work with different block flow values instead of being hard-coded to top-to-bottom.
LayoutUnit RenderTableCell::borderStart() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfStart(false)) : RenderBlockFlow::borderStart();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderStart();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfStart(false)) : RenderBlockFlow::borderStart();
}
LayoutUnit RenderTableCell::borderEnd() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfEnd(false)) : RenderBlockFlow::borderEnd();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderEnd();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfEnd(false)) : RenderBlockFlow::borderEnd();
}
LayoutUnit RenderTableCell::borderBefore() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfBefore(false)) : RenderBlockFlow::borderBefore();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderBefore();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfBefore(false)) : RenderBlockFlow::borderBefore();
}
LayoutUnit RenderTableCell::borderAfter() const
{
- return table()->collapseBorders() ? LayoutUnit::fromPixel(borderHalfAfter(false)) : RenderBlockFlow::borderAfter();
+ RenderTable* table = this->table();
+ if (!table)
+ return RenderBlockFlow::borderAfter();
+ return table->collapseBorders() ? LayoutUnit::fromPixel(borderHalfAfter(false)) : RenderBlockFlow::borderAfter();
}
int RenderTableCell::borderHalfLeft(bool outer) const
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderTableCell.h (180697 => 180698)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderTableCell.h 2015-02-26 22:04:13 UTC (rev 180697)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderTableCell.h 2015-02-26 22:18:10 UTC (rev 180698)
@@ -75,8 +75,20 @@
RenderTableCell* previousCell() const;
RenderTableRow* row() const { return toRenderTableRow(parent()); }
- RenderTableSection* section() const { return toRenderTableSection(parent()->parent()); }
- RenderTable* table() const { return toRenderTable(parent()->parent()->parent()); }
+ RenderTableSection* section() const
+ {
+ RenderTableRow* row = this->row();
+ if (!row)
+ return nullptr;
+ return toRenderTableSection(row->parent());
+ }
+ RenderTable* table() const
+ {
+ RenderTableSection* section = this->section();
+ if (!section)
+ return nullptr;
+ return toRenderTable(section->parent());
+ }
unsigned rowIndex() const
{
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
