Title: [103437] branches/safari-534.54-branch
- Revision
- 103437
- Author
- lforsch...@apple.com
- Date
- 2011-12-21 13:08:02 -0800 (Wed, 21 Dec 2011)
Log Message
Merged r94455.
Modified Paths
Added Paths
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (103436 => 103437)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2011-12-21 21:04:51 UTC (rev 103436)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2011-12-21 21:08:02 UTC (rev 103437)
@@ -1,5 +1,18 @@
2011-12-21 Lucas Forschler <lforsch...@apple.com>
+ Merge 94455
+
+ 2011-09-02 Dan Bernstein <m...@apple.com>
+
+ <rdar://problem/9755843> anonymous RenderMathMLOperator sets itself as the renderer of its parent mfenced node
+
+ Reviewed by Darin Adler.
+
+ * mathml/operator-hijacks-fenced-node-expected.txt: Added.
+ * mathml/operator-hijacks-fenced-node.xhtml: Added.
+
+2011-12-21 Lucas Forschler <lforsch...@apple.com>
+
Merge 94112
2011-08-30 Adam Barth <aba...@webkit.org>
Copied: branches/safari-534.54-branch/LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt (from rev 94455, trunk/LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt) (0 => 103437)
--- branches/safari-534.54-branch/LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/mathml/operator-hijacks-fenced-node-expected.txt 2011-12-21 21:08:02 UTC (rev 103437)
@@ -0,0 +1,3 @@
+This tests that an anonymous operator created by mfenced does not set itself as the mfenced node’s renderer.
+
+The test passes if it does not crash or cause an assertion failure.
Copied: branches/safari-534.54-branch/LayoutTests/mathml/operator-hijacks-fenced-node.xhtml (from rev 94455, trunk/LayoutTests/mathml/operator-hijacks-fenced-node.xhtml) (0 => 103437)
--- branches/safari-534.54-branch/LayoutTests/mathml/operator-hijacks-fenced-node.xhtml (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/mathml/operator-hijacks-fenced-node.xhtml 2011-12-21 21:08:02 UTC (rev 103437)
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+ <p>
+ This tests that an anonymous operator created by mfenced does not
+ set itself as the mfenced node’s renderer.
+ </p>
+ <p>
+ The test passes if it does not crash or cause an assertion failure.
+ </p>
+ <div id="container">
+ <m:math><span><m:mfenced id="target"><m:mo></m:mo></m:mfenced></span></m:math>
+ </div>
+ <script><![CDATA[
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ document.body.offsetTop;
+ document.getElementById("target").parentNode.insertBefore(document.createElement("div"), document.getElementById("target"));
+ document.body.offsetTop;
+ document.getElementById("container").style.display = "none";
+ ]]></script>
+</body>
+</html>
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (103436 => 103437)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2011-12-21 21:04:51 UTC (rev 103436)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2011-12-21 21:08:02 UTC (rev 103437)
@@ -1,5 +1,21 @@
2011-12-21 Lucas Forschler <lforsch...@apple.com>
+ Merge 94455
+
+ 2011-09-02 Dan Bernstein <m...@apple.com>
+
+ <rdar://problem/9755843> anonymous RenderMathMLOperator sets itself as the renderer of its parent mfenced node
+
+ Reviewed by Darin Adler.
+
+ Test: mathml/operator-hijacks-fenced-node.xhtml
+
+ * rendering/mathml/RenderMathMLOperator.cpp:
+ (WebCore::RenderMathMLOperator::updateFromElement): Rather than unconditionally setting the
+ node’s renderer to this, just restore it to whatever it was before calling destroyLeftoverChildren().
+
+2011-12-21 Lucas Forschler <lforsch...@apple.com>
+
Merge 94112
2011-08-30 Adam Barth <aba...@webkit.org>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp (103436 => 103437)
--- branches/safari-534.54-branch/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp 2011-12-21 21:04:51 UTC (rev 103436)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp 2011-12-21 21:08:02 UTC (rev 103437)
@@ -124,12 +124,14 @@
void RenderMathMLOperator::updateFromElement()
{
+ RenderObject* savedRenderer = node()->renderer();
+
// Destroy our current children
children()->destroyLeftoverChildren();
- // Since we share a node with our children, destroying our children will set our node's
- // renderer to 0, so we need to re-set it back to this.
- node()->setRenderer(this);
+ // Since we share a node with our children, destroying our children may set our node's
+ // renderer to 0, so we need to restore it.
+ node()->setRenderer(savedRenderer);
// If the operator is fixed, it will be contained in m_operator
UChar firstChar = m_operator;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
