nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/mathml/maction-removeChild-expecte...

4 lines
40 B
Plaintext
Raw Permalink Normal View History

Crash when removing children of a MathMLSelectElement https://bugs.webkit.org/show_bug.cgi?id=147704 <rdar://problem/21940321> Reviewed by Ryosuke Niwa. Source/WebCore: When MathMLSelectElement::childrenChanged() is called after its children have been removed, MathMLSelectElement calls updateSelectedChild() which accesses m_selectedChild. However, in this case, m_selectedChild is the previously selected child and it may be destroyed as this point if it was removed. To avoid this problem, MathMLSelectElement now keep a strong ref to the currently selected element. Test: mathml/maction-removeChild.html * mathml/MathMLSelectElement.h: LayoutTests: Add layout test that reproduces the crash under guardmalloc. * mathml/maction-removeChild-expected.txt: Added. * mathml/maction-removeChild.html: Added. Canonical link: https://commits.webkit.org/165794@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@188014 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2015-08-06 01:25:30 +00:00
This test passes if it does not crash