Changeset 142788 in webkit

Timestamp:

Feb 13, 2013 1:36:34 PM (11 years ago)

Author:

commit-queue@webkit.org

Message:

Crash when encountering <object style="resize:both;">
​https://bugs.webkit.org/show_bug.cgi?id=109728

Source/WebCore:

See also ​https://code.google.com/p/chromium/issues/detail?id=175535
This bug can be reproduced on
​http://dramalink.net/tudou.y/?xink=162601060

Patch by Christian Biesinger <​cbiesinger@chromium.org> on 2013-02-13
Reviewed by Eric Seidel.

Test: fast/css/resize-object-crash.html

• rendering/RenderWidget.cpp:

(WebCore::RenderWidget::paint):
Only call paintResizer() if we have a layer and canResize() is true

LayoutTests:

See also ​https://code.google.com/p/chromium/issues/detail?id=175535

Patch by Christian Biesinger <​cbiesinger@chromium.org> on 2013-02-13
Reviewed by Eric Seidel.

• fast/css/resize-object-crash-expected.txt: Added.
• fast/css/resize-object-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/resize-object-crash-expected.txt (added)
• LayoutTests/fast/css/resize-object-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderWidget.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-02-13  Christian Biesinger  <cbiesinger@chromium.org>
+
+        Crash when encountering <object style="resize:both;">
+        https://bugs.webkit.org/show_bug.cgi?id=109728
+
+        See also https://code.google.com/p/chromium/issues/detail?id=175535
+
+        Reviewed by Eric Seidel.
+
+        * fast/css/resize-object-crash-expected.txt: Added.
+        * fast/css/resize-object-crash.html: Added.
+
 2013-02-13  Kondapally Kalyan  <kalyan.kondapally@intel.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-02-13  Christian Biesinger  <cbiesinger@chromium.org>
+
+        Crash when encountering <object style="resize:both;">
+        https://bugs.webkit.org/show_bug.cgi?id=109728
+
+        See also https://code.google.com/p/chromium/issues/detail?id=175535
+        This bug can be reproduced on
+        http://dramalink.net/tudou.y/?xink=162601060
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/css/resize-object-crash.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        Only call paintResizer() if we have a layer and canResize() is true
+
 2013-02-13  Arko Saha  <arko@motorola.com>
 

trunk/Source/WebCore/rendering/RenderWidget.cpp

@@ -313 +313 @@
     }
 
-    if (style()->resize() != RESIZE_NONE)
+    if (hasLayer() && layer()->canResize())
         layer()->paintResizer(paintInfo.context, roundedIntPoint(adjustedPaintOffset), paintInfo.rect);
 }