Title: [117304] trunk
- Revision
- 117304
- Author
- [email protected]
- Date
- 2012-05-16 10:22:38 -0700 (Wed, 16 May 2012)
Log Message
Missing RenderApplet cast check in HTMLAppletElement::renderWidgetForJSBindings.
https://bugs.webkit.org/show_bug.cgi?id=86627
Reviewed by Andreas Kling.
Source/WebCore:
Test: java/inline-applet-crash.html
* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::renderWidgetForJSBindings):
LayoutTests:
* java/inline-applet-crash-expected.txt: Added.
* java/inline-applet-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (117303 => 117304)
--- trunk/LayoutTests/ChangeLog 2012-05-16 16:56:17 UTC (rev 117303)
+++ trunk/LayoutTests/ChangeLog 2012-05-16 17:22:38 UTC (rev 117304)
@@ -1,3 +1,13 @@
+2012-05-16 Abhishek Arya <[email protected]>
+
+ Missing RenderApplet cast check in HTMLAppletElement::renderWidgetForJSBindings.
+ https://bugs.webkit.org/show_bug.cgi?id=86627
+
+ Reviewed by Andreas Kling.
+
+ * java/inline-applet-crash-expected.txt: Added.
+ * java/inline-applet-crash.html: Added.
+
2012-05-16 Brady Eidson <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=86643
Added: trunk/LayoutTests/java/inline-applet-crash-expected.txt (0 => 117304)
--- trunk/LayoutTests/java/inline-applet-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/java/inline-applet-crash-expected.txt 2012-05-16 17:22:38 UTC (rev 117304)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: trunk/LayoutTests/java/inline-applet-crash.html (0 => 117304)
--- trunk/LayoutTests/java/inline-applet-crash.html (rev 0)
+++ trunk/LayoutTests/java/inline-applet-crash.html 2012-05-16 17:22:38 UTC (rev 117304)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<applet code=doesnotexist.class></applet>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.overridePreference("WebKitJavaEnabled", "1");
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function walk(arr, currentPrefix, index, domNode) {
+ if (!domNode)
+ return;
+
+ newPrefix = currentPrefix + "_" + index;
+ walk(arr, currentPrefix, index + 1, domNode.nextSibling);
+ walk(arr, newPrefix, 0, domNode.firstChild);
+}
+
+function crash() {
+ var temp = new Array();
+ walk(temp, "", 0, document.documentElement);
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+setTimeout("crash();", 0);
+</script>
+</html>
Property changes on: trunk/LayoutTests/java/inline-applet-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (117303 => 117304)
--- trunk/Source/WebCore/ChangeLog 2012-05-16 16:56:17 UTC (rev 117303)
+++ trunk/Source/WebCore/ChangeLog 2012-05-16 17:22:38 UTC (rev 117304)
@@ -1,3 +1,15 @@
+2012-05-16 Abhishek Arya <[email protected]>
+
+ Missing RenderApplet cast check in HTMLAppletElement::renderWidgetForJSBindings.
+ https://bugs.webkit.org/show_bug.cgi?id=86627
+
+ Reviewed by Andreas Kling.
+
+ Test: java/inline-applet-crash.html
+
+ * html/HTMLAppletElement.cpp:
+ (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+
2012-05-16 Pavel Feldman <[email protected]>
Web Inspector: extract CompositeUISourceCodeProvider from DebuggerScriptMapping.
Modified: trunk/Source/WebCore/html/HTMLAppletElement.cpp (117303 => 117304)
--- trunk/Source/WebCore/html/HTMLAppletElement.cpp 2012-05-16 16:56:17 UTC (rev 117303)
+++ trunk/Source/WebCore/html/HTMLAppletElement.cpp 2012-05-16 17:22:38 UTC (rev 117304)
@@ -115,10 +115,11 @@
if (!canEmbedJava())
return 0;
+ if (!renderer() || !renderer()->isApplet())
+ return 0;
+
RenderApplet* applet = toRenderApplet(renderer());
- if (applet)
- applet->createWidgetIfNecessary();
-
+ applet->createWidgetIfNecessary();
return applet;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
