Index: WebCore/ChangeLog |
=================================================================== |
--- WebCore/ChangeLog (revision 48057) |
+++ WebCore/ChangeLog (working copy) |
@@ -1,3 +1,16 @@ |
+2010-05-14 Abhishek Arya <inferno@chromium.org> |
+ |
+ Reviewed by David Hyatt. |
+ |
+ Move the m_width(Length) and m_columns(RenderTable::ColumnStruct) |
+ vector out-of-bounds check out of the ASSERT into the main code. |
+ https://bugs.webkit.org/show_bug.cgi?id=38261 |
+ |
+ Test: fast/table/fixed-table-layout-large-colspan-crash.html |
+ |
+ * rendering/FixedTableLayout.cpp: |
+ (WebCore::FixedTableLayout::calcWidthArray): |
+ |
2010-05-10 Sam Weinig <sam@webkit.org> |
Reviewed by Darin Adler. |