Summary: | Remove RenderTable::removeChild | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Julien Chaffraix <jchaffraix> | ||||
Component: | Tables | Assignee: | Julien Chaffraix <jchaffraix> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | bdakin, eric, hyatt, inferno, webkit.review.bot | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 94843 | ||||||
Attachments: |
|
Description
Julien Chaffraix
2012-08-23 13:44:34 PDT
Created attachment 160234 [details]
Proposed change: Added the proper willBeRemovedFromTree and moved the removeChild code there.
Comment on attachment 160234 [details] Proposed change: Added the proper willBeRemovedFromTree and moved the removeChild code there. Clearing flags on attachment: 160234 Committed r126495: <http://trac.webkit.org/changeset/126495> All reviewed patches have been landed. Closing bug. ASSERTION FAILED: index != notFound third_party/WebKit/Source/WebCore/rendering/RenderTable.cpp(203) : void WebCore::RenderTable::removeCaption(const WebCore::RenderTableCaption *) https://cluster-fuzz.appspot.com/testcase?key=98951173 Testcase:: <style>.caption { display: table-caption </style> >><div id=tCF86>><rp>><theader id=tCF98></theader><div class=caption>><setvar id=tCF108>><script> var docElement = document.body ? document.body : document.documentElement; docElement.contentEditable = "true"; function initCF() { setTimeout("CFcrash()", 408); } document.addEventListener("DOMContentLoaded", initCF, false); function selectRangeBetween(r, sNode, eNode) { window.getSelection().removeAllRanges(); r.setEnd(eNode, eNode.childNodes.length); window.getSelection().addRange(r); } function editFuzz() { try { r = document.createRange(); selectRangeBetween(r, tCF86, tCF108); } catch(e) {} try { document.execCommand("InsertText", false, "the mesage ") } catch(e) {} } function CFcrash() { try { tCF98.style.display = "table-caption" } catch(e) {} setTimeout("editFuzz()", 1922); }</script>> |