Changeset 85586 in webkit
- Timestamp:
- May 2, 2011 11:04:54 PM (13 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r85585 r85586 1 2011-05-02 Simon Fraser <simon.fraser@apple.com> 2 3 Reviewed by Dan Bernstein. 4 5 Possible crash when removing elements with reflections 6 https://bugs.webkit.org/show_bug.cgi?id=60009 7 8 Testcase that sometimes crashes if run with MallocScribble enabled. 9 10 * fast/reflections/remove-reflection-crash-expected.txt: Added. 11 * fast/reflections/remove-reflection-crash.html: Added. 12 1 13 2011-05-02 Ian Henderson <ianh@apple.com> 2 14 -
trunk/Source/WebCore/ChangeLog
r85585 r85586 1 2011-05-02 Simon Fraser <simon.fraser@apple.com> 2 3 Reviewed by Dan Bernstein. 4 5 Possible crash when removing elements with reflections 6 https://bugs.webkit.org/show_bug.cgi?id=60009 7 8 RenderLayer's destructor deleted its z-order list Vector pointers 9 before removing the reflection layer. However, the reflection cleanup 10 code could call back into the RenderLayer to dirty z-order lists, 11 so move reflection cleanup to before z-order vector deletion. 12 13 The test crashes when run manually a few times with MallocScribble enabled, 14 but I was not able to create a test that crashed reliably. 15 16 Test: fast/reflections/remove-reflection-crash.html 17 18 * rendering/RenderLayer.cpp: 19 (WebCore::RenderLayer::~RenderLayer): 20 1 21 2011-05-02 Ian Henderson <ianh@apple.com> 2 22 -
trunk/Source/WebCore/rendering/RenderLayer.cpp
r84815 r85586 212 212 destroyScrollbar(VerticalScrollbar); 213 213 214 if (m_reflection) 215 removeReflection(); 216 214 217 // Child layers will be deleted by their corresponding render objects, so 215 218 // we don't need to delete them ourselves. … … 226 229 // Make sure we have no lingering clip rects. 227 230 ASSERT(!m_clipRects); 228 229 if (m_reflection)230 removeReflection();231 231 232 232 if (m_scrollCorner)
Note: See TracChangeset
for help on using the changeset viewer.