Attachment 68162 Details for Bug 46140 – Patch

[patch] Patch

bug-46140-20100920171137.patch (text/plain), 3.78 KB, created by Simon Fraser (smfr) on 2010-09-20 17:11:38 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Simon Fraser (smfr)

Created: 2010-09-20 17:11:38 PDT

Size: 3.78 KB

patch

obsolete

>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 30dd7684535a024bf7391a30ca5a06f2692241b6..b315cb16c014f9855a23f3b710556f7f5e0d18d3 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,5 +1,17 @@
> 2010-09-20  Simon Fraser  <simon.fraser@apple.com>
> 
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Crash when div with content set to image gets composited (Vimeo).
>+        https://bugs.webkit.org/show_bug.cgi?id=46140
>+
>+        Test with a compositing div with content set to an image.
>+        
>+        * compositing/images/content-image-expected.txt: Copied from LayoutTests/fast/forms/select-change-popup-to-listbox-in-event-handler-expected.txt.
>+        * compositing/images/content-image.html: Added.
>+
>+2010-09-20  Simon Fraser  <simon.fraser@apple.com>
>+
>         Reviewed by Adam Roben.
> 
>         REGRESSION: alternating animation direction doesn't work on Windows
>diff --git a/LayoutTests/compositing/images/content-image-expected.txt b/LayoutTests/compositing/images/content-image-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..d31f6ea656c216705dcc928cfedbd33ed79e2c2a
>--- /dev/null
>+++ b/LayoutTests/compositing/images/content-image-expected.txt
>@@ -0,0 +1,3 @@
>+This test should not crash.
>+
>+
>diff --git a/LayoutTests/compositing/images/content-image.html b/LayoutTests/compositing/images/content-image.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..20f6d988d9d3507cb45a58296e98cdcf3462fa9c
>--- /dev/null
>+++ b/LayoutTests/compositing/images/content-image.html
>@@ -0,0 +1,19 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+    <style type="text/css" media="screen">
>+        .box {
>+            content: url('../resources/alpha-gradient-small.png');
>+            -webkit-transform: translateZ(0);
>+        }
>+    </style>
>+    <script type="text/javascript" charset="utf-8">
>+        if (window.layoutTestController)
>+            layoutTestController.dumpAsText();
>+    </script>
>+</head>
>+<body>
>+    <p>This test should not crash.</p>
>+    <div class="box"></div>
>+</body>
>+</html>
>diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
>index 5784093f720a4cd8c111c910ae0bd280ef803e3b..8d84b88e105b718b7dc2279a2c84aecbc8763439 100644
>--- a/WebCore/ChangeLog
>+++ b/WebCore/ChangeLog
>@@ -1,5 +1,24 @@
> 2010-09-20  Simon Fraser  <simon.fraser@apple.com>
> 
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Crash when div with content set to image gets composited (Vimeo).
>+        https://bugs.webkit.org/show_bug.cgi?id=46140
>+        
>+        When CSS specifies that the content of an element is an image, we make
>+        a RenderImage, and setStyle() before setting the image resource. In this
>+        case the compositing code can attempt to access the cached image, which
>+        would crash with a null deref.
>+        
>+        Fix by null-checking m_imageResource.
>+
>+        Test: compositing/images/content-image.html
>+
>+        * rendering/RenderImage.h:
>+        (WebCore::RenderImage::cachedImage):
>+
>+2010-09-20  Simon Fraser  <simon.fraser@apple.com>
>+
>         Reviewed by Adam Roben.
> 
>         REGRESSION: alternating animation direction doesn't work on Windows
>diff --git a/WebCore/rendering/RenderImage.h b/WebCore/rendering/RenderImage.h
>index a8666eebc5f2d3aecbf59534a829845fe22a7376..f9acba8c7da3d00afa637112bda590ea894beeb8 100644
>--- a/WebCore/rendering/RenderImage.h
>+++ b/WebCore/rendering/RenderImage.h
>@@ -41,7 +41,7 @@ public:
> 
>     RenderImageResource* imageResource() { return m_imageResource.get(); }
>     const RenderImageResource* imageResource() const { return m_imageResource.get(); }
>-    CachedImage* cachedImage() const { return m_imageResource->cachedImage(); }
>+    CachedImage* cachedImage() const { return m_imageResource ? m_imageResource->cachedImage() : 0; }
> 
>     bool setImageSizeForAltText(CachedImage* newImage = 0);
>

Flags:

darin: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 46140: 68162