Skip to content

GitLab

T
tangled
Commit fc841df9 authored by rtakacs.u-szeged@partner.samsung.com's avatar rtakacs.u-szeged@partner.samsung.com
Browse files
Options

ASSERTION FAILED: span >= 1 in WebCore::RenderTable::slowColElement 

Set the value of span to 1 if the given number is too big or zero.
Merged from WebKit (patch by Zsolt Borbely).
https://bugs.webkit.org/show_bug.cgi?id=129148

R=
BUG=351280

Review URL: https://codereview.chromium.org/194593005

git-svn-id: svn://svn.chromium.org/blink/trunk@169692 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 669ec61c
Hide whitespace changes
Inline Side-by-side
Showing with 79 additions and 1 deletion
third_party/WebKit/LayoutTests/fast/table/incorrect-colgroup-span-values-expected.txt 0 → 100644
View file @ fc841df9
This test checks that invalid 'span' values are rejected.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS document.getElementById('case1').span is 1
PASS document.getElementById('case2').span is 1
PASS document.getElementById('case3').span is 1
PASS document.getElementById('case4').span is 1
PASS document.getElementById('case5').span is 1
PASS document.getElementById('case6').span is 1
PASS successfullyParsed is true
TEST COMPLETE
third_party/WebKit/LayoutTests/fast/table/incorrect-colgroup-span-values.html 0 → 100644
View file @ fc841df9
<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test.js"></script>
<script type="text/javascript" charset="utf-8">
if (window.testRunner)
testRunner.dumpAsText();
function test()
{
description("This test checks that invalid 'span' values are rejected.");
// Remove "span" attribute (set it to null).
document.getElementById("case1").removeAttribute("span");
shouldBe("document.getElementById('case1').span", "1");
shouldBe("document.getElementById('case2').span", "1");
shouldBe("document.getElementById('case3').span", "1");
shouldBe("document.getElementById('case4').span", "1");
shouldBe("document.getElementById('case5').span", "1");
shouldBe("document.getElementById('case6').span", "1");
}
</script>
</head>
<body>
<table>
<colgroup id="case1" span="10000000000">
<th></th>
</colgroup>
</table>
<table>
<colgroup id="case2" span="0">
<th></th>
</colgroup>
</table>
<table>
<colgroup id="case3" span="10000000000">
<th></th>
</colgroup>
</table>
<table>
<colgroup id="case4" span="-10000000000">
<th></th>
</colgroup>
</table>
<table>
<colgroup id="case5" span="Szeged">
<th></th>
</colgroup>
</table>
<table>
<colgroup>
<col id="case6" span="...">
</colgroup>
</table>
<script>
test();
</script>
</body>
</html>
\ No newline at end of file
third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
View file @ fc841df9
...@@ -64,7 +64,10 @@ void HTMLTableColElement::collectStyleForPresentationAttribute(const QualifiedNa ...@@ -64,7 +64,10 @@ void HTMLTableColElement::collectStyleForPresentationAttribute(const QualifiedNa
void HTMLTableColElement::parseAttribute(const QualifiedName& name, const AtomicString& value) void HTMLTableColElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
{ {
if (name == spanAttr) { if (name == spanAttr) {
m_span = !value.isNull() ? value.toInt() : 1; int newSpan = value.toInt();
// If the value of span is not a valid non-negative integer greater than zero,
// set it to 1.
m_span = newSpan ? newSpan : 1;
if (renderer() && renderer()->isRenderTableCol()) if (renderer() && renderer()->isRenderTableCol())
renderer()->updateFromElement(); renderer()->updateFromElement();
} else if (name == widthAttr) { } else if (name == widthAttr) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment