Title: [91517] branches/safari-534.51-branch
- Revision
- 91517
- Author
- [email protected]
- Date
- 2011-07-21 15:09:11 -0700 (Thu, 21 Jul 2011)
Log Message
Merge r89780.
Modified Paths
Added Paths
Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (91516 => 91517)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-21 22:09:03 UTC (rev 91516)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-21 22:09:11 UTC (rev 91517)
@@ -1,5 +1,19 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 89780.
+
+ 2011-07-21 Lucas Forschler <[email protected]>
+
+ Reviewed by Kent Tamura.
+
+ m_formElementsWithFormAttribute doesn't ref the objects it holds
+ https://bugs.webkit.org/show_bug.cgi?id=62956
+
+ * fast/forms/form-associated-element-crash3-expected.txt: Added.
+ * fast/forms/form-associated-element-crash3.html: Added.
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 89769.
2011-06-26 Dan Bernstein <[email protected]>
Copied: branches/safari-534.51-branch/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt (from rev 89780, trunk/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt) (0 => 91517)
--- branches/safari-534.51-branch/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/forms/form-associated-element-crash3-expected.txt 2011-07-21 22:09:11 UTC (rev 91517)
@@ -0,0 +1 @@
+This test passes if it doesn't crash. Note: You might need to reload this test many times (or run the test under valgrind / ASAN) to see a crash.
Copied: branches/safari-534.51-branch/LayoutTests/fast/forms/form-associated-element-crash3.html (from rev 89780, trunk/LayoutTests/fast/forms/form-associated-element-crash3.html) (0 => 91517)
--- branches/safari-534.51-branch/LayoutTests/fast/forms/form-associated-element-crash3.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/forms/form-associated-element-crash3.html 2011-07-21 22:09:11 UTC (rev 91517)
@@ -0,0 +1,16 @@
+<body>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash. Note: You might need to reload this test
+many times (or run the test under valgrind / ASAN) to see a crash.
+<span>
+<span>
+<video src="" onloadstart>
+<form id="tjbvp"></form>
+</video>
+</span>
+</span>
+<keygen form="woujt">
+</body>
Modified: branches/safari-534.51-branch/Source/WebCore/ChangeLog (91516 => 91517)
--- branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-21 22:09:03 UTC (rev 91516)
+++ branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-21 22:09:11 UTC (rev 91517)
@@ -1,5 +1,20 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 89780.
+
+ 2011-06-26 Adam Barth <[email protected]>
+
+ Reviewed by Kent Tamura.
+
+ m_formElementsWithFormAttribute doesn't ref the objects it holds
+ https://bugs.webkit.org/show_bug.cgi?id=62956
+
+ Test: fast/forms/form-associated-element-crash3.html
+
+ * dom/Document.h:
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 89769.
2011-06-26 Dan Bernstein <[email protected]>
Modified: branches/safari-534.51-branch/Source/WebCore/dom/Document.h (91516 => 91517)
--- branches/safari-534.51-branch/Source/WebCore/dom/Document.h 2011-07-21 22:09:03 UTC (rev 91516)
+++ branches/safari-534.51-branch/Source/WebCore/dom/Document.h 2011-07-21 22:09:11 UTC (rev 91517)
@@ -1251,7 +1251,7 @@
typedef ListHashSet<Element*, 64> FormElementListHashSet;
FormElementListHashSet m_formElementsWithState;
- typedef ListHashSet<FormAssociatedElement*, 32> FormAssociatedElementListHashSet;
+ typedef ListHashSet<RefPtr<FormAssociatedElement>, 32> FormAssociatedElementListHashSet;
FormAssociatedElementListHashSet m_formElementsWithFormAttribute;
typedef HashMap<FormElementKey, Vector<String>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
