2011-06-13 Jeffrey Pfau <jpfau@apple.com>
authorcommit-queue <commit-queue@webkit.org>
Mon, 13 Jun 2011 23:20:47 +0000 (23:20 +0000)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Tue, 14 Jun 2011 14:36:24 +0000 (11:36 -0300)
commit7a48fd27b9e8d6f56b226bbd51064175146baa8b
tree613076f4855e1f4c10a3456682dedf6ebaa4fcff
parent8c92d0cf0201d8b3a4c7fbd77caef06cd4951aa6
2011-06-13  Jeffrey Pfau  <jpfau@apple.com>

        Reviewed by Darin Adler.

        Crash in WebCore::RenderMathMLUnderOver::layout()
        https://bugs.webkit.org/show_bug.cgi?id=57900

        Added a test that tries to remove the children of munder, mover and munderover elements.

        * mathml/munderover-remove-children-expected.txt: Added.
        * mathml/munderover-remove-children.html: Added.
2011-06-13  Jeffrey Pfau  <jpfau@apple.com>

        Reviewed by Darin Adler.

        Crash in WebCore::RenderMathMLUnderOver::layout()
        https://bugs.webkit.org/show_bug.cgi?id=57900

        Add more null checks so that removing children in MathML elements does not cause crashes.
        Note that this only half fixes the third repro in the Bugzilla bug, as another bug will
        still crash that repro.

        Test: mathml/munderover-remove-children.html

        * rendering/mathml/RenderMathMLSubSup.cpp:
        (WebCore::RenderMathMLSubSup::stretchToHeight):
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::layout):
        (WebCore::RenderMathMLUnderOver::nonOperatorHeight):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88730 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/mathml/munderover-remove-children-expected.txt [new file with mode: 0644]
LayoutTests/mathml/munderover-remove-children.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp