Changeset 128431 in webkit

Timestamp:

Sep 13, 2012, 2:11:04 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

[EFL] REGRESSION (r128274): fast/overflow/overflow-height-float-not-removed-crash.html
​https://bugs.webkit.org/show_bug.cgi?id=96619

Patch by Mikhail Pozdnyakov <​mikhail.pozdnyakov@intel.com> on 2012-09-13
Reviewed by Kenneth Rohde Christiansen.

ThemePartCacheEntry::create() can return '0' if creation fails, this was not checked
while Theme Part cache populating. A NULL pointer was dereferenced then causing crash.

Test: fast/overflow/overflow-height-float-not-removed-crash.html.

• platform/efl/RenderThemeEfl.cpp:

(WebCore::RenderThemeEfl::getThemePartFromCache):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/efl/RenderThemeEfl.cpp (modified) (4 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-09-13  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] REGRESSION (r128274): fast/overflow/overflow-height-float-not-removed-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=96619
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        ThemePartCacheEntry::create() can return '0' if creation fails, this was not checked
+        while Theme Part cache populating. A NULL pointer was dereferenced then causing crash.
+
+        Test: fast/overflow/overflow-height-float-not-removed-crash.html.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::getThemePartFromCache):
+
 2012-09-13  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/WebCore/platform/efl/RenderThemeEfl.cpp

@@ -279 +279 @@
     for (size_t i = 0; it != end; i++, it++) {
         ThemePartCacheEntry* entry = *it;
+        ASSERT(entry);
         if (entry->size == size) {
             if (entry->type == type)
@@ -288 +289 @@
     if (m_partCache.size() < RENDER_THEME_EFL_PART_CACHE_MAX) {
         ThemePartCacheEntry* entry = ThemePartCacheEntry::create(themePath(), type, size);
-        m_partCache.prepend(entry);
+        if (entry) // Can be '0', if creation fails. Do not store it in this case.
+            m_partCache.prepend(entry);
         return entry;
     }
@@ -297 +299 @@
     if (lastWithRequestedSize != notFound && lastWithRequestedSize != 1) {
         ThemePartCacheEntry* entry = m_partCache.at(lastWithRequestedSize);
+        ASSERT(entry);
         entry->reuse(themePath(), type);
         m_partCache.remove(lastWithRequestedSize);
@@ -304 +307 @@
 
     ThemePartCacheEntry* entry = m_partCache.last();
+    ASSERT(entry);
     entry->reuse(themePath(), type, size);
     m_partCache.removeLast();