38695 2010-05-06 14:47:59 -0700 Missing null check in RenderIFrame::calcWidth() and RenderIFrame::calcHeight() 2010-05-06 18:03:30 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 adachan adachan abarth ddkilzer eric webkit.review.bot zwarich oldest_to_newest 221978 0 adachan 2010-05-06 14:47:59 -0700 In RenderIFrame::calcWidth() and RenderIFrame::calcHeight(), we should null check the result from widget() before accessing it. There's no guarantee that it's not null, and I've seen inconsistently reproducible crashes due to that. 221982 1 55302 adachan 2010-05-06 14:52:01 -0700 Created attachment 55302 Patch 222011 2 55302 ddkilzer 2010-05-06 15:36:59 -0700 Comment on attachment 55302 Patch r=me 222024 3 adachan 2010-05-06 15:53:50 -0700 Fixed in http://trac.webkit.org/changeset/58915 222095 4 webkit.review.bot 2010-05-06 18:03:30 -0700 http://trac.webkit.org/changeset/58915 might have broken Qt Windows 32-bit Release The following changes are on the blame list: http://trac.webkit.org/changeset/58912 http://trac.webkit.org/changeset/58913 http://trac.webkit.org/changeset/58914 http://trac.webkit.org/changeset/58915 http://trac.webkit.org/changeset/58916 http://trac.webkit.org/changeset/58917 http://trac.webkit.org/changeset/58918 55302 2010-05-06 14:52:01 -0700 2010-05-06 15:36:59 -0700 Patch 38695.patch.txt text/plain 1524 adachan SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1ODkwOCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMTAtMDUtMDYgIEFkYSBDaGFuICA8YWRhY2hhbkBhcHBsZS5jb20+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM4Njk1CisgICAgICAgIAorICAgICAg ICBDaGVjayB0aGUgcmVzdWx0IGZyb20gd2lkZ2V0KCkgZm9yIE5VTEwgYmVmb3JlIGFjY2Vzc2lu ZyBpdC4KKworICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJJRnJhbWUuY3BwOgorICAgICAgICAo V2ViQ29yZTo6UmVuZGVySUZyYW1lOjpjYWxjSGVpZ2h0KToKKyAgICAgICAgKFdlYkNvcmU6OlJl bmRlcklGcmFtZTo6Y2FsY1dpZHRoKToKKwogMjAxMC0wNS0wNiAgUGF2ZWwgRmVsZG1hbiAgPHBm ZWxkbWFuQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBKb3NlcGggUGVjb3Jh cm8uCkluZGV4OiBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJJRnJhbWUuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlcklGcmFtZS5jcHAJKHJldmlzaW9uIDU4OTA0KQor KysgV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVySUZyYW1lLmNwcAkod29ya2luZyBjb3B5KQpAQCAt NTEsNiArNTEsOCBAQCB2b2lkIFJlbmRlcklGcmFtZTo6Y2FsY0hlaWdodCgpCiAKICAgICBpZiAo aXNTY3JvbGxhYmxlIHx8ICFzdHlsZSgpLT5oZWlnaHQoKS5pc0ZpeGVkKCkpIHsKICAgICAgICAg RnJhbWVWaWV3KiB2aWV3ID0gc3RhdGljX2Nhc3Q8RnJhbWVWaWV3Kj4od2lkZ2V0KCkpOworICAg ICAgICBpZiAoIXZpZXcpCisgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIGludCBib3JkZXIg PSBib3JkZXJUb3AoKSArIGJvcmRlckJvdHRvbSgpOwogICAgICAgICBzZXRIZWlnaHQobWF4KGhl aWdodCgpLCB2aWV3LT5jb250ZW50c0hlaWdodCgpICsgYm9yZGVyKSk7CiAgICAgfQpAQCAtNjcs NiArNjksOCBAQCB2b2lkIFJlbmRlcklGcmFtZTo6Y2FsY1dpZHRoKCkKIAogICAgIGlmIChpc1Nj cm9sbGFibGUgfHwgIXN0eWxlKCktPndpZHRoKCkuaXNGaXhlZCgpKSB7CiAgICAgICAgIEZyYW1l VmlldyogdmlldyA9IHN0YXRpY19jYXN0PEZyYW1lVmlldyo+KHdpZGdldCgpKTsKKyAgICAgICAg aWYgKCF2aWV3KQorICAgICAgICAgICAgcmV0dXJuOwogICAgICAgICBpbnQgYm9yZGVyID0gYm9y ZGVyTGVmdCgpICsgYm9yZGVyUmlnaHQoKTsKICAgICAgICAgc2V0V2lkdGgobWF4KHdpZHRoKCks IHZpZXctPmNvbnRlbnRzV2lkdGgoKSArIGJvcmRlcikpOwogICAgIH0K