=== WebCore-417.19 ===

2006-01-18  Timothy Hatcher  <timothy@apple.com>

        Merged fix from TOT to Safari-2-0-branch

    2006-01-17  Beth Dakin  <bdakin@apple.com>

        Reviewed by Hyatt and Darin

        Fix for <rdar://problem/4405836> REGRESSION: crash at webmail.aol.com 
        when deleting mail in khtml::RenderTableCell::collapsedBottomBorder() const 
        + 232

        RenderTableCell::collapsedBottomBorder() gets nextCell by calling 
        table()->cellBelow(this). In the case of the crash, cellBelow() returns 
        a pointer to a table cell that was already destroyed. cellBelow() thinks 
        that the pointer is still good because the grid of cells has not been updated 
        because all of this code is called through the hitTest and the hitTest does 
        not update the layout. The fix that I have is simply it have the hitTest call 
        updateLayout(). This is the only change in behavior. The rest of the patch 
        preserves behavior for simulated clicks. fast/events/stopPropagation-submit 
        caught this problem that arose from calling updateLayout() in the hitTest; 
        we should always have an x and y position of 0 for simulated clicks. This 
        preserves that behavior by keeping track of whether a click is simulated or not.

        * khtml/html/HTMLInputElementImpl.cpp:
        (DOM::HTMLInputElementImpl::defaultEventHandler): If the click is simulated, 
        set xPos and yPos to 0.
        * khtml/html/html_elementimpl.cpp:
        (HTMLElementImpl::setContentEditable): Fix spacing.
        (HTMLElementImpl::click): It isn't necessary to check if there is a renderer.
        * khtml/rendering/render_layer.cpp:
        (khtml::RenderLayer::hitTest): Call updateLayout().
        * khtml/xml/NodeImpl.cpp:
        (WebCore::NodeImpl::dispatchSimulatedMouseEvent): Set isSimulated to true.
        (WebCore::NodeImpl::dispatchMouseEvent): Keep track of isSimulated.
        * khtml/xml/NodeImpl.h: Same.
        * khtml/xml/dom2_eventsimpl.cpp:
        (DOM::MouseRelatedEventImpl::MouseRelatedEventImpl): Add isSimulated to
        MouseRelatedEventImpl().
        (DOM::MouseRelatedEventImpl::computePositions): Only change the offsets if 
        it's not simulated.
        (DOM::MouseEventImpl::MouseEventImpl): Add isSimulated to MouseEventImpl()
        * khtml/xml/dom2_eventsimpl.h: 
        (DOM::MouseRelatedEventImpl::isSimulated): Declarations of isSimulated
        (DOM::MouseEventImpl::isSimulated): Same.

=== WebCore-417.18.1 ===

2006-01-05  Adele Peterson  <adele@apple.com>

        Merged fix from TOT to Safari-2-0-branch

    2005-10-25  Beth Dakin  <bdakin@apple.com>

        Reviewed by Maciej

        Fix for <rdar://problem/4148730> SureSec si#182 safari heap overflow.
        When a table has a really huge rowSpan, Safari used to crash because
        the malloc of the grid for the table failed. This fix just checks for
        the success of the malloc.

        * khtml/rendering/render_table.cpp:
        (RenderTableSection::ensureRows): Return false if the grid resize is not 
        successful.
        (RenderTableSection::addCell): Return early if ensureRows() returned false.
        * khtml/rendering/render_table.h: Make ensureRows() return a bool instead
        of void.

=== WebCore-417.18 ===

2005-12-23  Geoffrey Garen  <ggaren@apple.com>

        - Fixed <rdar://problem/4392583> REGRESSION: Reproducible crash while viewing Opera's "why we're better than Safari" site, http://www.howtocreate.co.uk/browserSpeed.html, in khtml::RenderBlock::nodeAtPoint

        Fix by Darin, reviewed and landed by me.

        * khtml/rendering/render_container.cpp:
        (RenderContainer::updatePseudoChild): Don't have the parent call removeChild, because the child calls parent()->removeChild() on itself in detach().

=== WebCore-417.17 ===

2005-12-21  Adele Peterson  <adele@apple.com>

        Reviewed by Tim Hatcher.

        Fix for <rdar://problem/4387433> Seed: Radio buttons behave incorrectly in Gmail settings

        * khtml/html/html_formimpl.cpp:
        (DOM::HTMLFormElementImpl::registerFormElement): If this form element is already checked in the default form, remove it from m_selectedRadioButtons and add it for the new form.

=== WebCore-417.16 ===

2005-12-20  Adele Peterson  <adele@apple.com>

        Reviewed by Darin.

        Fix for <rdar://problem/4387630> REGRESSION: <select> element's onClick event doesn't fire @ bugweb.apple.com

        * kwq/KWQKHTMLPart.mm:
        (KWQKHTMLPart::passSubframeEventToSubframe): only pass mouse down for khtmlviews.

== Rolled over to ChangeLog-2005-12-19 ==

