Changeset 101091 in webkit


Ignore:
Timestamp:
Nov 23, 2011, 10:33:59 AM (14 years ago)
Author:
Antti Koivisto
Message:

​https://bugs.webkit.org/show_bug.cgi?id=72354
Image pointer in FillLayer not cleared correctly

Reviewed by Dan Bernstein.

Source/WebCore:

Test: fast/css/fill-layer-crash.html

We should clear the image pointer too, not just the m_imageSet bit.

  • rendering/style/FillLayer.h:

(WebCore::FillLayer::clearImage):

LayoutTests:

  • fast/css/fill-layer-crash-expected.txt: Added.
  • fast/css/fill-layer-crash.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r101090 r101091  
     12011-11-23  Antti Koivisto  <antti@apple.com>
     2
     3        https://bugs.webkit.org/show_bug.cgi?id=72354
     4        Image pointer in FillLayer not cleared correctly
     5
     6        Reviewed by Dan Bernstein.
     7
     8        * fast/css/fill-layer-crash-expected.txt: Added.
     9        * fast/css/fill-layer-crash.html: Added.
     10
    1112011-11-23  Mike Reed  <reed@google.com>
    212

  • trunk/Source/WebCore/ChangeLog

    r101088 r101091  
     12011-11-23  Antti Koivisto  <antti@apple.com>
     2
     3        https://bugs.webkit.org/show_bug.cgi?id=72354
     4        Image pointer in FillLayer not cleared correctly
     5
     6        Reviewed by Dan Bernstein.
     7
     8        Test: fast/css/fill-layer-crash.html
     9       
     10        We should clear the image pointer too, not just the m_imageSet bit.
     11
     12        * rendering/style/FillLayer.h:
     13        (WebCore::FillLayer::clearImage):
     14
    1152011-11-23  Sheriff Bot  <webkit.review.bot@gmail.com>
    216

  • trunk/Source/WebCore/rendering/style/FillLayer.h

    r76248 r101091  
    106106    void setSize(FillSize f) { m_sizeType = f.type; m_sizeLength = f.size; }
    107107   
    108     void clearImage() { m_imageSet = false; }
     108    void clearImage() { m_image.clear(); m_imageSet = false; }
    109109    void clearXPosition() { m_xPosSet = false; }
    110110    void clearYPosition() { m_yPosSet = false; }
Note: See TracChangeset for help on using the changeset viewer.