[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.1.15-1-40151-g37bb677

[darin]

The following commit has been merged in the debian/unstable branch:
commit 2b11557ca42bf024c26a12506bd6b9e584e35bf3
Author: darin <darin at 268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Jan 30 16:08:36 2003 +0000

            Reviewed by Maciej.
    
            - fixed 3158958 -- nil-dereference in KJS::DOMNode::getValueProperty at www.babyage.com
    
            * khtml/ecma/kjs_dom.cpp: (DOMNode::getValueProperty):
            Move the code that gets the render object down after the point where the render tree
            is updated, so we don't end up using a stale pointer.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@3505 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2003-10-25 b/WebCore/ChangeLog-2003-10-25
index 3b2efdf..cee0e25 100644
--- a/WebCore/ChangeLog-2003-10-25
+++ b/WebCore/ChangeLog-2003-10-25
@@ -1,5 +1,15 @@
 2003-01-29  Darin Adler  <darin at apple.com>
 
+        Reviewed by Maciej.
+
+        - fixed 3158958 -- nil-dereference in KJS::DOMNode::getValueProperty at www.babyage.com
+
+        * khtml/ecma/kjs_dom.cpp: (DOMNode::getValueProperty):
+        Move the code that gets the render object down after the point where the render tree
+        is updated, so we don't end up using a stale pointer.
+
+2003-01-29  Darin Adler  <darin at apple.com>
+
         - add new assertion that Dave can use to debug bug 3155954 tomorrow
 
         * khtml/rendering/render_arena.cpp: (RenderArena::allocate): Assert that the arena is not 0.
diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 3b2efdf..cee0e25 100644
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,5 +1,15 @@
 2003-01-29  Darin Adler  <darin at apple.com>
 
+        Reviewed by Maciej.
+
+        - fixed 3158958 -- nil-dereference in KJS::DOMNode::getValueProperty at www.babyage.com
+
+        * khtml/ecma/kjs_dom.cpp: (DOMNode::getValueProperty):
+        Move the code that gets the render object down after the point where the render tree
+        is updated, so we don't end up using a stale pointer.
+
+2003-01-29  Darin Adler  <darin at apple.com>
+
         - add new assertion that Dave can use to debug bug 3155954 tomorrow
 
         * khtml/rendering/render_arena.cpp: (RenderArena::allocate): Assert that the arena is not 0.
diff --git a/WebCore/khtml/ecma/kjs_dom.cpp b/WebCore/khtml/ecma/kjs_dom.cpp
index 0d17a4b..23e11a4 100644
--- a/WebCore/khtml/ecma/kjs_dom.cpp
+++ b/WebCore/khtml/ecma/kjs_dom.cpp
@@ -146,8 +146,6 @@ Value DOMNode::tryGet(ExecState *exec, const Identifier &propertyName) const
 
 Value DOMNode::getValueProperty(ExecState *exec, int token) const
 {
-  khtml::RenderObject *rend = node.handle() ? node.handle()->renderer() : 0L;
-
   switch (token) {
   case NodeName:
     return getString(node.nodeName());
@@ -240,6 +238,8 @@ Value DOMNode::getValueProperty(ExecState *exec, int token) const
         docimpl->view()->layout();
     }
 
+    khtml::RenderObject *rend = node.handle() ? node.handle()->renderer() : 0L;
+
     switch (token) {
     case OffsetLeft:
       return rend ? static_cast<Value>(Number(rend->offsetLeft())) : Value(Undefined());

-- 
WebKit Debian packaging