[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 14:34:01 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit d7e79707cf00120337e99e2f780c6fd93e93ab3e
Author: yael.aharon at nokia.com <yael.aharon at nokia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Oct 13 12:27:51 2010 +0000

    2010-10-13  Yael Aharon  <yael.aharon at nokia.com>
    
            Reviewed by Andreas Kling.
    
            Wrong ASSERT when select element has size 0
            https://bugs.webkit.org/show_bug.cgi?id=47567
    
            * fast/dom/HTMLSelectElement/click-size-zero-no-crash-expected.txt: Added.
            * fast/dom/HTMLSelectElement/click-size-zero-no-crash.html: Added.
    2010-10-13  Yael Aharon  <yael.aharon at nokia.com>
    
            Reviewed by Andreas Kling.
    
            Wrong ASSERT when select element has size 0
            https://bugs.webkit.org/show_bug.cgi?id=47567
    
            Keep the ASSERT only if the size of the element list is more than 0
            Test: fast/dom/HTMLSelectElement/click-size-zero-no-crash.html
    
            * dom/SelectElement.cpp:
            (WebCore::SelectElement::updateListBoxSelection):
            (WebCore::SelectElement::listBoxDefaultEventHandler):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@69651 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 234d0e5..7448d1c 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-13  Yael Aharon  <yael.aharon at nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Wrong ASSERT when select element has size 0
+        https://bugs.webkit.org/show_bug.cgi?id=47567
+
+        * fast/dom/HTMLSelectElement/click-size-zero-no-crash-expected.txt: Added.
+        * fast/dom/HTMLSelectElement/click-size-zero-no-crash.html: Added.
+
 2010-10-13  Nikolas Zimmermann  <nzimmermann at rim.com>
 
         Not reviewed.
diff --git a/LayoutTests/fast/dom/HTMLSelectElement/click-size-zero-no-crash-expected.txt b/LayoutTests/fast/dom/HTMLSelectElement/click-size-zero-no-crash-expected.txt
new file mode 100644
index 0000000..8011c14
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLSelectElement/click-size-zero-no-crash-expected.txt
@@ -0,0 +1 @@
+ This should not crash
diff --git a/LayoutTests/fast/dom/HTMLSelectElement/click-size-zero-no-crash.html b/LayoutTests/fast/dom/HTMLSelectElement/click-size-zero-no-crash.html
new file mode 100644
index 0000000..df44e72
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLSelectElement/click-size-zero-no-crash.html
@@ -0,0 +1,33 @@
+<html>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+function getCenterFor(element)
+{
+  var rect = element.getBoundingClientRect();
+  return { x : parseInt((rect.left + rect.right) / 2) , y : parseInt((rect.top + rect.bottom) / 2)};
+}
+
+function runTest()
+{
+  if (!window.layoutTestController)
+    return;
+  if (!window.eventSender)
+    return;
+
+  layoutTestController.dumpAsText();
+  center = getCenterFor(document.getElementById("emptyselect"));
+  eventSender.mouseMoveTo(center.x, center.y);
+  eventSender.mouseDown();
+  eventSender.mouseUp();
+  eventSender.keyDown("downArrow");
+}
+
+</script>
+<style>
+</style>
+<body onload="runTest();">
+<select multiple id="emptyselect"></select>
+This should not crash
+</body>
+</html>
+
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 7cfa45b..4e53d14 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2010-10-13  Yael Aharon  <yael.aharon at nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Wrong ASSERT when select element has size 0
+        https://bugs.webkit.org/show_bug.cgi?id=47567
+
+        Keep the ASSERT only if the size of the element list is more than 0
+        Test: fast/dom/HTMLSelectElement/click-size-zero-no-crash.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
 2010-10-13  Steve Block  <steveblock at google.com>
 
         Reviewed by Alexey Proskuryakov.
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index 1af012e..c8af399 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -152,7 +152,7 @@ void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int inde
 void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
 {
     ASSERT(element->renderer() && (element->renderer()->isListBox() || data.multiple()));
-    ASSERT(data.activeSelectionAnchorIndex() >= 0);
+    ASSERT(!data.listItems(element).size() || data.activeSelectionAnchorIndex() >= 0);
 
     unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
     unsigned end = max(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
@@ -752,7 +752,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
             saveLastSelection(data, element);
 
-            ASSERT_UNUSED(listItems, endIndex >= 0 && (unsigned) endIndex < listItems.size());
+            ASSERT_UNUSED(listItems, !listItems.size() || (endIndex >= 0 && (unsigned) endIndex < listItems.size()));
             setActiveSelectionEndIndex(data, endIndex);
             
             // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.

-- 
WebKit Debian packaging

