Changeset 126919 in webkit

Timestamp:

Aug 28, 2012, 1:10:49 PM (14 years ago)

Author:

Simon Fraser

Message:

Regression (r126774): Crash when scrolling after removing sticky element.
​https://bugs.webkit.org/show_bug.cgi?id=95174

Reviewed by Abhishek Arya.

Source/WebCore:

RenderBox::willBeDestroyed() needs to check for both fixed and sticky
position to determine whether to remove an object from FrameView's
set of fixed objects.

Test: fast/css/sticky/remove-sticky-crash.html

• rendering/RenderBox.cpp:

(WebCore::RenderBox::willBeDestroyed):

LayoutTests:

Testcase with JS that removes a position:sticky element, then scrolls.

• fast/css/sticky/remove-sticky-crash-expected.txt: Added.
• fast/css/sticky/remove-sticky-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/sticky/remove-sticky-crash-expected.txt (added)
• LayoutTests/fast/css/sticky/remove-sticky-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBox.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Regression (r126774): Crash when scrolling after removing sticky element.
+        https://bugs.webkit.org/show_bug.cgi?id=95174
+
+        Reviewed by Abhishek Arya.
+
+        Testcase with JS that removes a position:sticky element, then scrolls.
+
+        * fast/css/sticky/remove-sticky-crash-expected.txt: Added.
+        * fast/css/sticky/remove-sticky-crash.html: Added.
+
 2012-08-28  Robert Hogan  <robert@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Regression (r126774): Crash when scrolling after removing sticky element.
+        https://bugs.webkit.org/show_bug.cgi?id=95174
+
+        Reviewed by Abhishek Arya.
+
+        RenderBox::willBeDestroyed() needs to check for both fixed and sticky
+        position to determine whether to remove an object from FrameView's
+        set of fixed objects.
+
+        Test: fast/css/sticky/remove-sticky-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed):
+
 2012-08-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
 

trunk/Source/WebCore/rendering/RenderBox.cpp

@@ -140 +140 @@
         if (RenderView* view = this->view()) {
             if (FrameView* frameView = view->frameView()) {
-                if (style()->position() == FixedPosition)
+                if (style()->hasViewportConstrainedPosition())
                     frameView->removeFixedObject(this);
             }