Changeset 67641 in webkit

Timestamp:

Sep 16, 2010 11:06:48 AM (14 years ago)

Author:

commit-queue@webkit.org

Message:

2010-09-16 Daniel Cheng <​dcheng@chromium.org>

Reviewed by Tony Chang.

Fix incorrect usage of dissolveDragImageToFraction().
​https://bugs.webkit.org/show_bug.cgi?id=45835

createDragImageForSelection() was ignoring the return value of
dissolveDragImageToFraction(). This didn't happen to crash on most
platforms, since most implementations simply modified the image that was
passed in. However, Chromium Mac's implementation actually creates a new
image and returns that instead. This caused us to crash when copying the
image from the renderer to the browser process, since the memory had
already been freed.

• manual-tests/selection-drag-crash.html: Added.
• platform/DragImage.cpp: (WebCore::createDragImageForSelection):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• manual-tests/selection-drag-crash.html (added)
• platform/DragImage.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-09-16  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Fix incorrect usage of dissolveDragImageToFraction().
+        https://bugs.webkit.org/show_bug.cgi?id=45835
+
+        createDragImageForSelection() was ignoring the return value of
+        dissolveDragImageToFraction(). This didn't happen to crash on most
+        platforms, since most implementations simply modified the image that was
+        passed in. However, Chromium Mac's implementation actually creates a new
+        image and returns that instead. This caused us to crash when copying the
+        image from the renderer to the browser process, since the memory had
+        already been freed.
+
+        * manual-tests/selection-drag-crash.html: Added.
+        * platform/DragImage.cpp:
+        (WebCore::createDragImageForSelection):
+
 2010-09-16  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/WebCore/platform/DragImage.cpp

@@ -70 +70 @@
     DragImageRef image = frame->dragImageForSelection();
     if (image)
-        dissolveDragImageToFraction(image, DragController::DragImageAlpha);
+        image = dissolveDragImageToFraction(image, DragController::DragImageAlpha);
     return image;
 }