Bug 18879 - Reproducible crash when removing a gradient
Summary: Reproducible crash when removing a gradient
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2008-05-03 20:48 PDT by mitz
Modified: 2008-05-04 15:07 PDT (History)
1 user (show)

See Also:


Attachments
Test case (will crash) (280 bytes, text/html)
2008-05-03 20:49 PDT, mitz
no flags Details
Make clients implicitly ref() the CSSImageGeneratorValue (3.77 KB, patch)
2008-05-03 21:23 PDT, mitz
sam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2008-05-03 20:48:58 PDT
The attached test case crashes beneath StyleGeneratedImage::removeClient(), because the CSSImageGeneratorValue is deleted when the background-image property is removed.
Comment 1 mitz 2008-05-03 20:49:21 PDT
Created attachment 20954 [details]
Test case (will crash)
Comment 2 mitz 2008-05-03 20:49:51 PDT
<rdar://problem/5909481>
Comment 3 mitz 2008-05-03 21:23:49 PDT
Created attachment 20955 [details]
Make clients implicitly ref() the CSSImageGeneratorValue

The "autoDeref" trick may be the wrong trade-off between readability and leak safety for such a small function. I can replace it with a deref() at the end.
Comment 4 Sam Weinig 2008-05-04 14:03:10 PDT
Comment on attachment 20955 [details]
Make clients implicitly ref() the CSSImageGeneratorValue

I think you should replace the "autoDeref" trick with a deref at the end to make the calls symmetrical.  r=me, the change is up to you though.
Comment 5 mitz 2008-05-04 15:07:55 PDT
Fixed in <http://trac.webkit.org/changeset/32854>.