| Summary: | marquee with display:inline causes crash | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Shinichiro Hamaji <hamaji> | ||||||||||
| Component: | CSS | Assignee: | Nobody <webkit-unassigned> | ||||||||||
| Status: | RESOLVED FIXED | ||||||||||||
| Severity: | Normal | CC: | eric, hyatt, webkit.review.bot | ||||||||||
| Priority: | P2 | ||||||||||||
| Version: | 528+ (Nightly build) | ||||||||||||
| Hardware: | PC | ||||||||||||
| OS: | OS X 10.5 | ||||||||||||
| Attachments: |
|
||||||||||||
Created attachment 44606 [details]
Patch v1
style-queue ran check-webkit-style on attachment 44606 [details] without any errors.
Comment on attachment 44606 [details]
Patch v1
renderMarquee() could be const, no?
I expect there is lots of code which uses layer()->renderBox(). I wonder how much of the rest of it is wrong.
Created attachment 44719 [details]
Patch v2
style-queue ran check-webkit-style on attachment 44719 [details] without any errors.
> renderMarquee() could be const, no? Fixed, thanks. > I expect there is lots of code which uses layer()->renderBox(). I wonder how > much of the rest of it is wrong. Yeah, I think there would be some other crashes, but I couldn't find other crashes so far. I'm guessing toRenderBox in RenderLayer::calculate{,Clip}Rects can cause crashes, but I'm not sure. Created attachment 44777 [details]
Patch v3
Fixed a wrong changelog diff. style-queue ran check-webkit-style on attachment 44777 [details] without any errors.
Comment on attachment 44777 [details]
Patch v3
I don’t think this is correct. You should just not create a RenderMarquee for an inline. Just change the condition in RenderLayer::styleChanged() to also check that the renderer is a box.
Created attachment 45047 [details]
Patch v4
style-queue ran check-webkit-style on attachment 45047 [details] without any errors.
Ah, I see. I was unsure if marquee will never be inline. Thanks! I think we still need the fix for HTMLMarqueeElement as the code assumes it has box renderer. Comment on attachment 45047 [details] Patch v4 > +RenderMarquee* HTMLMarqueeElement::renderMarquee() const > +{ > + if (renderer() && renderer()->hasLayer() && renderBoxModelObject()->layer()->marquee()) > + return renderBoxModelObject()->layer()->marquee(); > + return 0; You don’t need the “&& renderBoxModelObject()->layer()->marquee()” condition. Committed r52299: <http://trac.webkit.org/changeset/52299> |
The following HTML makes WebKit crash. <body> <div style="opacity: 0.9;"> <marquee style="opacity: 0.9; display: inline;">No crash means PASS</marquee> </div> </body> This happens because the marquee code assumes RenderLayer's renderer is a box.