Changeset 92025 in webkit

Timestamp:

Jul 29, 2011 3:48:49 PM (13 years ago)

Author:

eae@chromium.org

Message:

-webkit-marquee with anonymous node causes segmentation fault in Node::document
​https://bugs.webkit.org/show_bug.cgi?id=64693

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/css/webkit-marquee-anonymous-node-crash.html

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo):
Add null check as renderer()->node() is null for anonymous nodes.

LayoutTests:

• fast/css/webkit-marquee-anonymous-node-crash-expected.txt: Added.
• fast/css/webkit-marquee-anonymous-node-crash.html: Added.

Add test for using -webkit-marquee with an anonymous node.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/webkit-marquee-anonymous-node-crash-expected.txt (added)
• LayoutTests/fast/css/webkit-marquee-anonymous-node-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderLayer.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-29  Emil A Eklund  <eae@chromium.org>
+
+        -webkit-marquee with anonymous node causes segmentation fault in Node::document
+        https://bugs.webkit.org/show_bug.cgi?id=64693
+
+        Reviewed by Simon Fraser.
+
+        * fast/css/webkit-marquee-anonymous-node-crash-expected.txt: Added.
+        * fast/css/webkit-marquee-anonymous-node-crash.html: Added.
+        Add test for using -webkit-marquee with an anonymous node.
+
 2011-07-29  Mike Reed  <reed@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-29  Emil A Eklund  <eae@chromium.org>
+
+        -webkit-marquee with anonymous node causes segmentation fault in Node::document
+        https://bugs.webkit.org/show_bug.cgi?id=64693
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/css/webkit-marquee-anonymous-node-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollTo):
+        Add null check as renderer()->node() is null for anonymous nodes.
+
 2011-07-29  Mike Reed  <reed@google.com>
 

trunk/Source/WebCore/rendering/RenderLayer.cpp

@@ -1377 +1377 @@
 
     // Schedule the scroll DOM event.
-    renderer()->node()->document()->eventQueue()->enqueueOrDispatchScrollEvent(renderer()->node(), EventQueue::ScrollEventElementTarget);
+    if (renderer()->node())
+        renderer()->node()->document()->eventQueue()->enqueueOrDispatchScrollEvent(renderer()->node(), EventQueue::ScrollEventElementTarget);
 }