nephele/haikuwebkit - haikuwebkit - GryphNode

nephele

/

haikuwebkit

2 lines

116 B

Plaintext

Raw Permalink Normal View History

Source/WebCore: Invalid cast in WebCore::toRenderMathMLBlock https://bugs.webkit.org/show_bug.cgi?id=121728 rdar://problem/15046151 Reviewed by Dean Jackson. Tested by: mathml/arbitrary-markup.html * dom/Element.h: Expose childShouldCreateRenderer for MathML as well as SVG builds. * dom/Node.h: (WebCore::Node::isMathMLElement): Added. * mathml/MathMLElement.cpp: (WebCore::MathMLElement::create): Create as MathML Element. (WebCore::MathMLElement::childShouldCreateRenderer): Only allow the child to emit a renderer if it is a MathML element. * mathml/MathMLElement.h: LayoutTests: [MathML] invalid cast in WebCore::toRenderMathMLBlock https://bugs.webkit.org/show_bug.cgi?id=121728 Reviewed by Dean Jackson. * mathml/arbitrary-markup-expected.txt: Added. * mathml/arbitrary-markup.html: Added. * mathml/mfenced-root-layer.html: Modified to avoid invalid use of arbitrary markup inside mfenced element. * mathml/mfenced-root-layer-expected.txt: Rebaselined. Canonical link: https://commits.webkit.org/141571@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@158198 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2013-10-29 17:40:52 +00:00

Bug 100764: Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]. This test passes if it does not crash.