Changeset 145443 in webkit

Timestamp:

Mar 11, 2013, 5:48:27 PM (14 years ago)

Author:

cevans@google.com

Message:

Merge 142760
BUG=172993
Review URL: ​https://codereview.chromium.org/12558011

Location:

branches/chromium/1410

Files:

• ManualTests/scrolling-coordinator-viewport-constrained-crash.html (copied) (copied from trunk/ManualTests/scrolling-coordinator-viewport-constrained-crash.html )
• Source/WebCore/rendering/RenderBoxModelObject.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderLayerModelObject.cpp (modified) (1 diff)

branches/chromium/1410/Source/WebCore/rendering/RenderBoxModelObject.cpp

@@ -331 +331 @@
     // A continuation of this RenderObject should be destroyed at subclasses.
     ASSERT(!continuation());
-
-    if (isPositioned()) {
-        if (RenderView* view = this->view()) {
-            if (FrameView* frameView = view->frameView()) {
-                if (style()->hasViewportConstrainedPosition())
-                    frameView->removeViewportConstrainedObject(this);
-            }
-        }
-    }
 
     // If this is a first-letter object with a remaining text fragment then the

branches/chromium/1410/Source/WebCore/rendering/RenderLayerModelObject.cpp

@@ -77 +77 @@
 void RenderLayerModelObject::willBeDestroyed()
 {
+    if (isPositioned()) {
+        // Don't use this->view() because the document's renderView has been set to 0 during destruction.
+        if (Frame* frame = this->frame()) {
+            if (FrameView* frameView = frame->view()) {
+                if (style()->hasViewportConstrainedPosition())
+                    frameView->removeViewportConstrainedObject(this);
+            }
+        }
+    }
+
     // RenderObject::willBeDestroyed calls back to destroyLayer() for layer destruction
     RenderObject::willBeDestroyed();