Changeset 136558 in webkit

Timestamp:

Dec 4, 2012, 1:29:22 PM (13 years ago)

Author:

inferno@chromium.org

Message:

Crash in CachedResource::checkNotify due to -webkit-crossfade.
​https://bugs.webkit.org/show_bug.cgi?id=98068

Reviewed by Nate Chapin.

Source/WebCore:

Make sure to not re-add the same client again for |m_cachedFromImage|
and |m_cachedToImage|. This would otherwise cause the CSSCrossfadeValue
client to not get removed from its cached image resource (when it is
going away).

Test: fast/images/crossfade-client-not-removed-crash.html

• css/CSSCrossfadeValue.cpp:

(WebCore::CSSCrossfadeValue::loadSubimages):

LayoutTests:

• fast/images/crossfade-client-not-removed-crash-expected.txt: Added.
• fast/images/crossfade-client-not-removed-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/images/crossfade-client-not-removed-crash-expected.txt (added)
• LayoutTests/fast/images/crossfade-client-not-removed-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSCrossfadeValue.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-12-04  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in CachedResource::checkNotify due to -webkit-crossfade.
+        https://bugs.webkit.org/show_bug.cgi?id=98068
+
+        Reviewed by Nate Chapin.
+
+        * fast/images/crossfade-client-not-removed-crash-expected.txt: Added.
+        * fast/images/crossfade-client-not-removed-crash.html: Added.
+
 2012-12-04  Roger Fong  <roger_fong@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-12-04  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in CachedResource::checkNotify due to -webkit-crossfade.
+        https://bugs.webkit.org/show_bug.cgi?id=98068
+
+        Reviewed by Nate Chapin.
+
+        Make sure to not re-add the same client again for |m_cachedFromImage|
+        and |m_cachedToImage|. This would otherwise cause the CSSCrossfadeValue
+        client to not get removed from its cached image resource (when it is
+        going away).
+
+        Test: fast/images/crossfade-client-not-removed-crash.html
+
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::CSSCrossfadeValue::loadSubimages):
+
 2012-12-04  Julien Chaffraix  <jchaffraix@webkit.org>
 

trunk/Source/WebCore/css/CSSCrossfadeValue.cpp

@@ -147 +147 @@
 void CSSCrossfadeValue::loadSubimages(CachedResourceLoader* cachedResourceLoader)
 {
+    CachedResourceHandle<CachedImage> oldCachedFromImage = m_cachedFromImage;
+    CachedResourceHandle<CachedImage> oldCachedToImage = m_cachedToImage;
+
     m_cachedFromImage = cachedImageForCSSValue(m_fromValue.get(), cachedResourceLoader);
     m_cachedToImage = cachedImageForCSSValue(m_toValue.get(), cachedResourceLoader);
 
-    if (m_cachedFromImage)
-        m_cachedFromImage->addClient(&m_crossfadeSubimageObserver);
-    if (m_cachedToImage)
-        m_cachedToImage->addClient(&m_crossfadeSubimageObserver);
+    if (m_cachedFromImage != oldCachedFromImage) {
+        if (oldCachedFromImage)
+            oldCachedFromImage->removeClient(&m_crossfadeSubimageObserver);
+        if (m_cachedFromImage)
+            m_cachedFromImage->addClient(&m_crossfadeSubimageObserver);
+    }
+
+    if (m_cachedToImage != oldCachedToImage) {
+        if (oldCachedToImage)
+            oldCachedToImage->removeClient(&m_crossfadeSubimageObserver);
+        if (m_cachedToImage)
+            m_cachedToImage->addClient(&m_crossfadeSubimageObserver);
+    }
 
     m_crossfadeSubimageObserver.setReady(true);