diff options
| author | mjs <mjs@bbb929c8-8fbe-4397-9dbb-9b2b20218538> | 2006-07-14 07:45:13 +0000 |
|---|---|---|
| committer | mjs <mjs@bbb929c8-8fbe-4397-9dbb-9b2b20218538> | 2006-07-14 07:45:13 +0000 |
| commit | 9386749cab3c7da44c7513b90b6252012795ddbe (patch) | |
| tree | dc49b9bf53d13524208486abd6a0bad32349dec5 /third_party/WebKit/LayoutTests/fast/table/section-in-table-before-misnested-text-crash-expected.txt | |
| parent | 8063ae98c6af99a1a905d7dd8b9b29bf55553bab (diff) | |
| download | chromium_src-9386749cab3c7da44c7513b90b6252012795ddbe.zip chromium_src-9386749cab3c7da44c7513b90b6252012795ddbe.tar.gz chromium_src-9386749cab3c7da44c7513b90b6252012795ddbe.tar.bz2 | |
LayoutTests:
Reviewed by Hyatt.
Test cases for <rdar://problem/4567031> REGRESSION: Crash at WebCore::RenderBlock::createLineBoxes (seems to be a security hole?)
I included the test case from the bug plus variants for other broken cases that
were similar but needed separate fixes.
* fast/table/cell-in-row-before-misnested-text-crash-expected.txt: Added.
* fast/table/cell-in-row-before-misnested-text-crash.xhtml: Added.
* fast/table/form-in-row-before-misnested-text-crash-expected.txt: Added.
* fast/table/form-in-row-before-misnested-text-crash.xhtml: Added.
* fast/table/form-in-table-before-misnested-text-crash-expected.txt: Added.
* fast/table/form-in-table-before-misnested-text-crash.xhtml: Added.
* fast/table/form-in-tbody-before-misnested-text-crash-expected.txt: Added.
* fast/table/form-in-tbody-before-misnested-text-crash.xhtml: Added.
* fast/table/row-in-tbody-before-misnested-text-crash-expected.txt: Added.
* fast/table/row-in-tbody-before-misnested-text-crash.xhtml: Added.
* fast/table/section-in-table-before-misnested-text-crash-expected.txt: Added.
* fast/table/section-in-table-before-misnested-text-crash.xhtml: Added.
WebCore:
Reviewed by Hyatt.
- fixed <rdar://problem/4567031> REGRESSION: Crash at WebCore::RenderBlock::createLineBoxes (seems to be a security hole?)
I also fixed all the similar crash / assertion failure cases I could think of.
* dom/Node.cpp:
(WebCore::Node::nextRendererWithSameParent): Helper function for some of the above.
* dom/Node.h:
* rendering/RenderTable.cpp:
(WebCore::RenderTable::addChild): Don't allow inserting forms when not in
an HTML document, since we don't need that quirk and because parsing won't
do certain render tree fixups. Also watch out for case when inserting before
the renderer of a misnested child.
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::addChild): ditto
* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::addChild): ditto
git-svn-id: svn://svn.chromium.org/blink/trunk@15421 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Diffstat (limited to 'third_party/WebKit/LayoutTests/fast/table/section-in-table-before-misnested-text-crash-expected.txt')
| -rw-r--r-- | third_party/WebKit/LayoutTests/fast/table/section-in-table-before-misnested-text-crash-expected.txt | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/third_party/WebKit/LayoutTests/fast/table/section-in-table-before-misnested-text-crash-expected.txt b/third_party/WebKit/LayoutTests/fast/table/section-in-table-before-misnested-text-crash-expected.txt new file mode 100644 index 0000000..f7129ce --- /dev/null +++ b/third_party/WebKit/LayoutTests/fast/table/section-in-table-before-misnested-text-crash-expected.txt @@ -0,0 +1,5 @@ +This test checks whether a particular odd arrangement of DOM nodes results in render tree consistency violations. +0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 xxx +Whee +QQQ + |