diff options
| author | Ben Murdoch <benm@google.com> | 2010-10-21 17:02:36 +0100 |
|---|---|---|
| committer | Ben Murdoch <benm@google.com> | 2010-10-21 17:02:36 +0100 |
| commit | 80a0e2c21aa3d6657bbf3fbd69e5eb624f16a1bf (patch) | |
| tree | adab91c5f5a3588b476a632e761d732b8a921e65 | |
| parent | d3bed0e7c739f46e955406b920498b86724e7705 (diff) | |
| download | external_webkit-80a0e2c21aa3d6657bbf3fbd69e5eb624f16a1bf.zip external_webkit-80a0e2c21aa3d6657bbf3fbd69e5eb624f16a1bf.tar.gz external_webkit-80a0e2c21aa3d6657bbf3fbd69e5eb624f16a1bf.tar.bz2 | |
Cherry-pick WebKit security fix (webkit.org r68408) Do not merge
See http://trac.webkit.org/changeset/68408
Change-Id: I53167c57f32a43c6bd80a1aca8126f41cb01da53
| -rw-r--r-- | WebCore/rendering/RenderListItem.cpp | 2 | ||||
| -rw-r--r-- | WebCore/rendering/RenderListMarker.cpp | 3 |
2 files changed, 2 insertions, 3 deletions
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp index 54a7dd2..c613cbe 100644 --- a/WebCore/rendering/RenderListItem.cpp +++ b/WebCore/rendering/RenderListItem.cpp @@ -253,7 +253,7 @@ void RenderListItem::layout() void RenderListItem::positionListMarker() { - if (m_marker && !m_marker->isInside() && m_marker->inlineBoxWrapper()) { + if (m_marker && m_marker->parent()->isBox() && !m_marker->isInside() && m_marker->inlineBoxWrapper()) { int markerOldX = m_marker->x(); int yOffset = 0; int xOffset = 0; diff --git a/WebCore/rendering/RenderListMarker.cpp b/WebCore/rendering/RenderListMarker.cpp index d0353ee..6ba6bf5 100644 --- a/WebCore/rendering/RenderListMarker.cpp +++ b/WebCore/rendering/RenderListMarker.cpp @@ -1138,8 +1138,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty) void RenderListMarker::layout() { ASSERT(needsLayout()); - ASSERT(!prefWidthsDirty()); - + if (isImage()) { setWidth(m_image->imageSize(this, style()->effectiveZoom()).width()); setHeight(m_image->imageSize(this, style()->effectiveZoom()).height()); |