Source/WebCore: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody
authorAbhishek Arya <inferno@chromium.org>
Sun, 14 Aug 2011 23:08:11 +0000 (23:08 +0000)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Mon, 15 Aug 2011 20:06:00 +0000 (17:06 -0300)
commitfbfc2f9a18a55802204a8e95dd22bb5c1fe49f1a
tree7a66b94b69561c9b6d9db9295fc12ccb873d3f9f
parenta755bead1f11d4d721d7dee518c566345e6ea484
Source/WebCore: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody
https://bugs.webkit.org/show_bug.cgi?id=66187

Reviewed by Adam Barth.

RefPtr a few ContainerNodes to prevent premature deletion.

Test: fast/html/process-end-tag-for-inbody-crash.html

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
(WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
(WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

LayoutTests: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody.
https://bugs.webkit.org/show_bug.cgi?id=66187

Reviewed by Adam Barth.

* fast/html/process-end-tag-for-inbody-crash-expected.txt: Added.
* fast/html/process-end-tag-for-inbody-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93032 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/html/process-end-tag-for-inbody-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/html/process-end-tag-for-inbody-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/parser/HTMLTreeBuilder.cpp