Attachment #145536 for bug #88217

View Details Raw Unified Return to Bug 88217



2012-06-04  Antti Koivisto  <antti@apple.com>

        Crash in WebCore::RenderView::getRetainedWidgets
        https://bugs.webkit.org/show_bug.cgi?id=88217

        Reviewed by NOBODY (OOPS!).
        
        There is no known repro, the crash has been seen on the field. It is likely that it happens with frame
        flattening enabled only.

        Null check root renderer in performPostLayoutTasks. The root can legitimely be null for several reasons and
        is mostly null checked everywhere else.

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2012-05-31  Kinuko Yasuda  <kinuko@chromium.org>

        [chromium] DataTransferItem.webkitGetAsEntry() should synchronously return entry



    m_frame->loader()->client()->dispatchDidLayout();

    RenderView* root = rootRenderer(this);
    if (root)
        root->updateWidgetPositions();
    
    for (unsigned i = 0; i < maxUpdateWidgetsIterations; i++) {
        if (updateWidgets())


    m_actionScheduler->resume();

    if (root && !root->printing()) {
        IntSize currentSize;
        if (useFixedLayout() && !fixedLayoutSize().isEmpty() && delegatesScrolling())
            currentSize = fixedLayoutSize();

Return to Bug 88217

Lines 2374-2380 void FrameView::performPostLayoutTasks() Source/WebCore/page/FrameView.cpp_sec1
- Source/WebCore/page/FrameView.cpp -2 / +3 lines
2374	m_frame->loader()->client()->dispatchDidLayout();	2374	m_frame->loader()->client()->dispatchDidLayout();
2375		2375
2376	RenderView* root = rootRenderer(this);	2376	RenderView* root = rootRenderer(this);
2377	root->updateWidgetPositions();	2377	if (root)
		2378	root->updateWidgetPositions();
2378		2379
2379	for (unsigned i = 0; i < maxUpdateWidgetsIterations; i++) {	2380	for (unsigned i = 0; i < maxUpdateWidgetsIterations; i++) {
2380	if (updateWidgets())	2381	if (updateWidgets())
Lines 2395-2401 void FrameView::performPostLayoutTasks() Source/WebCore/page/FrameView.cpp_sec2
2395		2396
2396	m_actionScheduler->resume();	2397	m_actionScheduler->resume();
2397		2398
2398	if (!root->printing()) {	2399	if (root && !root->printing()) {
2399	IntSize currentSize;	2400	IntSize currentSize;
2400	if (useFixedLayout() && !fixedLayoutSize().isEmpty() && delegatesScrolling())	2401	if (useFixedLayout() && !fixedLayoutSize().isEmpty() && delegatesScrolling())
2401	currentSize = fixedLayoutSize();	2402	currentSize = fixedLayoutSize();

Lines 1-3 Source/WebCore/ChangeLog_sec1
- Source/WebCore/ChangeLog +16 lines
		1	2012-06-04 Antti Koivisto <antti@apple.com>
		2
		3	Crash in WebCore::RenderView::getRetainedWidgets
		4	https://bugs.webkit.org/show_bug.cgi?id=88217
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	There is no known repro, the crash has been seen on the field. It is likely that it happens with frame
		9	flattening enabled only.
		10
		11	Null check root renderer in performPostLayoutTasks. The root can legitimely be null for several reasons and
		12	is mostly null checked everywhere else.
		13
		14	* page/FrameView.cpp:
		15	(WebCore::FrameView::performPostLayoutTasks):
		16
1	2012-05-31 Kinuko Yasuda <kinuko@chromium.org>	17	2012-05-31 Kinuko Yasuda <kinuko@chromium.org>
2		18
3	[chromium] DataTransferItem.webkitGetAsEntry() should synchronously return entry	19	[chromium] DataTransferItem.webkitGetAsEntry() should synchronously return entry