Bug 45835 – Fix incorrect usage of dissolveDragImageToFraction

• Component: Platform
• Status: RESOLVED FIXED

[Daniel Cheng]

createDragImageForSelection() was ignoring the return value of dissolveDragImageToFraction(). This didn't happen to crash on most platforms, since most implementations simply modified the image that was passed in. However, Chromium Mac's implementation actually creates a new image and returns that instead. This caused us to crash when copying the image from the renderer to the browser process, since the memory had already been freed.

[Daniel Cheng]

Created attachment 67711 [details]
Patch

[Tony Chang]

Comment on attachment 67711 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=67711&action=prettypatch

Can you add a manual test in WebCore/manual-tests/chromium for this?

[Daniel Cheng]

Created attachment 67717 [details]
Patch

[Daniel Cheng]

Created attachment 67728 [details]
Patch

[Tony Chang]

Comment on attachment 67728 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=67728&action=prettypatch

> WebCore/ChangeLog:16
> +        * manual-tests/selection-drag-crash.html: Added.
Please add a comment saying why this doesn't repro in DRT or test_shell.

> WebCore/manual-tests/selection-drag-crash.html:6
> +function selectText() {
> +    window.getSelection().selectAllChildren(document.body);
> +};
Nit: The semi-colon at the end of the test is not needed.

[Daniel Cheng]

Created attachment 67735 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 67735 [details]
Patch for landing

Rejecting patch 67735 from commit-queue.

[e-mail] does not have committer permissions according to http://trac.webkit.org/browser/trunk/WebKitTools/Scripts/webkitpy/common/config/committers.py.

- If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags.

- If you have committer rights please correct the error in WebKitTools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed).  The commit-queue restarts itself every 2 hours.  After restart the commit-queue will correctly respect your committer rights.

[Tony Chang]

Comment on attachment 67735 [details]
Patch for landing

thought that might happen.  let's try that again.

[WebKit Commit Bot]

Comment on attachment 67735 [details]
Patch for landing

Rejecting patch 67735 from commit-queue.

Unexpected failure when processing patch!  Please file a bug against webkit-patch.
Failed to run "['WebKitTools/Scripts/webkit-patch', '--status-host=queues.webkit.org', 'land-attachment', '--force-clean', '--non-interactive', '--ignore-builders', '--quiet', '--parent-command=commit-queue', 67735]" exit_code: 1
Last 500 characters of output:
.cgi?id=67735&action=edit
Fetching: https://bugs.webkit.org/show_bug.cgi?id=45835&ctype=xml
Processing 1 patch from 1 bug.
Cleaning working directory
Updating working directory
Processing patch 67735 from bug 45835.
NOBODY (OOPS!) found in /Projects/CommitQueue/WebCore/ChangeLog does not appear to be a valid reviewer according to committers.py.
ERROR: /Projects/CommitQueue/WebCore/ChangeLog neither lists a valid reviewer nor contains the string "Unreviewed" or "Rubber stamp" (case insensitive).

[WebKit Commit Bot]

Comment on attachment 67735 [details]
Patch for landing

Clearing flags on attachment: 67735

Committed r67641: <http://trac.webkit.org/changeset/67641>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.