Bug 117465
| Summary: | Potential crash in FrameView::updateScrollCorner | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> |
| Component: | Page Loading | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | ahmad.saleem792, ap, darin |
| Priority: | P2 | Keywords: | BlinkMergeCandidate |
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Ryosuke Niwa
We might want to merge https://chromium.googlesource.com/chromium/blink/+/525efd3cc851df1545133547a172ddfdb55b2645
if we can reproduce or has been getting reports for the said crash.
Don't know how to reproduce but it seems the only possibility of crash:
If frameView::updateScrollCorner() is called when the FrameView doesn't have
the document or (body and documentElement), and the owner iframe/frame
element has scrollbar corner style, then |renderer| will be NULL and
it'll crash at line 2736.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Ahmad Saleem
I tried this in PR below:
https://github.com/WebKit/WebKit/pull/4854
But I get build failures and it is beyond my expertise to fix this. I think if there is any potential crash issue, we should fix it. Although this merge is beyond my expertise. Thanks!