Changeset 151875 in webkit

Timestamp:

Jun 21, 2013 7:36:13 PM (11 years ago)

Author:

ggaren@apple.com

Message:

Crashes due to NULL dereference beneath WebCore::StyleResolver::loadPendingSVGDocuments and related functions
​https://bugs.webkit.org/show_bug.cgi?id=117903

Reviewed by Darin Adler.

• css/StyleResolver.cpp:

(WebCore::StyleResolver::loadPendingSVGDocuments): Add a NULL check for
RenderStyle here...
(WebCore::StyleResolver::loadPendingResources): ...and here.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• css/StyleResolver.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-06-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Crashes due to NULL dereference beneath WebCore::StyleResolver::loadPendingSVGDocuments and related functions
+        https://bugs.webkit.org/show_bug.cgi?id=117903
+
+        Reviewed by Darin Adler.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::loadPendingSVGDocuments): Add a NULL check for
+        RenderStyle here...
+        (WebCore::StyleResolver::loadPendingResources): ...and here.
+
 2013-06-21  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/css/StyleResolver.cpp

@@ -3563 +3563 @@
 {
     State& state = m_state;
-    if (!state.style()->hasFilter() || state.pendingSVGDocuments().isEmpty())
+
+    // Crash reports indicate that we've seen calls to this function when our
+    // style is NULL. We don't know exactly why this happens. Our guess is
+    // reentering styleForElement().
+    ASSERT(state.style());
+    if (!state.style() || !state.style()->hasFilter() || state.pendingSVGDocuments().isEmpty())
         return;
 
@@ -4196 +4201 @@
 void StyleResolver::loadPendingResources()
 {
+    // We've seen crashes in all three of the functions below. Some of them
+    // indicate that style() is NULL. This NULL check will cut down on total
+    // crashes, while the ASSERT will help us find the cause in debug builds.
+    ASSERT(style());
+    if (!style())
+        return;
+
     // Start loading images referenced by this style.
     loadPendingImages();