Changeset 29457 in webkit

Timestamp:

Jan 13, 2008 8:40:46 PM (16 years ago)

Author:

mitz@apple.com

Message:

Reviewed by Darin Adler.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=16865 fast/layers/resize-layer-deletion-crash.html crashes under GuardMalloc

• rendering/RenderBox.cpp: (WebCore::RenderBox::destroy): Removed the call to RenderLayer::destroy() from here, because ~RenderLayer() calls RenderObject() methods.
• rendering/RenderObject.cpp: (WebCore::RenderObject::destroy): Added the call to RenderLayer::destroy() here.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBox.cpp (modified) (1 diff)
• rendering/RenderObject.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-01-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16865
+          fast/layers/resize-layer-deletion-crash.html crashes under GuardMalloc
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy): Removed the call to
+        RenderLayer::destroy() from here, because ~RenderLayer() calls
+        RenderObject() methods.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy): Added the call to
+        RenderLayer::destroy() here.
+
 2008-01-13  Eric Seidel  <eric@webkit.org>
 

trunk/WebCore/rendering/RenderBox.cpp

@@ -165 +165 @@
         gOverrideSizeMap->remove(this);
 
-    RenderLayer* layer = m_layer;
-    RenderArena* arena = renderArena();
-
     // This must be done before we destroy the RenderObject.
-    if (layer)
-        layer->clearClipRect();
+    if (m_layer)
+        m_layer->clearClipRect();
 
     RenderObject::destroy();
-
-    if (layer)
-        layer->destroy(arena);
 }
 

trunk/WebCore/rendering/RenderObject.cpp

@@ -2546 +2546 @@
     remove();
 
-    arenaDelete(document()->renderArena(), this);
+    RenderArena* arena = renderArena();
+
+    if (hasLayer())
+        layer()->destroy(arena);
+
+    arenaDelete(arena, this);
 }