Changeset 274645 in webkit
- Timestamp:
- Mar 18, 2021 7:44:01 AM (3 years ago)
- Location:
- trunk
- Files:
-
- 4 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r274644 r274645 1 2021-03-18 Frédéric Wang <fwang@igalia.com> 2 3 Nullptr crash in RenderStyle::shapeOutside() 4 https://bugs.webkit.org/show_bug.cgi?id=221382 5 6 Reviewed by Zalan Bujtas. 7 8 Add regression tests. 9 10 * fast/block/float/float-pseudo-element-not-removed-crash-expected.txt: Added. 11 * fast/block/float/float-pseudo-element-not-removed-crash.html: Added. 12 * fast/block/float/float-pseudo-element-not-removed-crash2-expected.txt: Added. 13 * fast/block/float/float-pseudo-element-not-removed-crash2.html: Added. 14 1 15 2021-03-18 Imanol Fernandez <ifernandez@igalia.com> 2 16 -
trunk/Source/WebCore/ChangeLog
r274644 r274645 1 2021-03-18 Frédéric Wang <fwang@igalia.com> 2 3 Nullptr crash in RenderStyle::shapeOutside() 4 https://bugs.webkit.org/show_bug.cgi?id=221382 5 6 Reviewed by Zalan Bujtas. 7 8 Before bug 223041, it was possible to get dangling WeakPtr m_renderer on FloatingObject. This 9 patch adds debug ASSERT and more regression tests. 10 11 Tests: fast/block/float/float-pseudo-element-not-removed-crash.html 12 fast/block/float/float-pseudo-element-not-removed-2-crash.html 13 14 * rendering/FloatingObjects.h: add nullcheck ASSERT for debug builds. 15 1 16 2021-03-18 Imanol Fernandez <ifernandez@igalia.com> 2 17 -
trunk/Source/WebCore/rendering/FloatingObjects.h
r273210 r274645 50 50 51 51 Type type() const { return static_cast<Type>(m_type); } 52 RenderBox& renderer() const { return *m_renderer; }52 RenderBox& renderer() const { ASSERT(m_renderer); return *m_renderer; } 53 53 54 54 bool isPlaced() const { return m_isPlaced; } … … 175 175 176 176 private: 177 const RenderBlockFlow& renderer() const { return *m_renderer; }177 const RenderBlockFlow& renderer() const { ASSERT(m_renderer); return *m_renderer; } 178 178 void computePlacedFloatsTree(); 179 179 const FloatingObjectTree* placedFloatsTree();
Note: See TracChangeset
for help on using the changeset viewer.