createDragImageForSelection() was ignoring the return value of dissolveDragImageToFraction(). This didn't happen to crash on most platforms, since most implementations simply modified the image that was passed in. However, Chromium Mac's implementation actually creates a new image and returns that instead. This caused us to crash when copying the image from the renderer to the browser process, since the memory had already been freed.
Created attachment 67711 [details] Patch
Comment on attachment 67711 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=67711&action=prettypatch Can you add a manual test in WebCore/manual-tests/chromium for this?
Created attachment 67717 [details] Patch
Created attachment 67728 [details] Patch
Comment on attachment 67728 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=67728&action=prettypatch > WebCore/ChangeLog:16 > + * manual-tests/selection-drag-crash.html: Added. Please add a comment saying why this doesn't repro in DRT or test_shell. > WebCore/manual-tests/selection-drag-crash.html:6 > +function selectText() { > + window.getSelection().selectAllChildren(document.body); > +}; Nit: The semi-colon at the end of the test is not needed.
Created attachment 67735 [details] Patch for landing
Comment on attachment 67735 [details] Patch for landing Rejecting patch 67735 from commit-queue. dcheng@chromium.org does not have committer permissions according to http://trac.webkit.org/browser/trunk/WebKitTools/Scripts/webkitpy/common/config/committers.py. - If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have committer rights please correct the error in WebKitTools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your committer rights.
Comment on attachment 67735 [details] Patch for landing thought that might happen. let's try that again.
Comment on attachment 67735 [details] Patch for landing Rejecting patch 67735 from commit-queue. Unexpected failure when processing patch! Please file a bug against webkit-patch. Failed to run "['WebKitTools/Scripts/webkit-patch', '--status-host=queues.webkit.org', 'land-attachment', '--force-clean', '--non-interactive', '--ignore-builders', '--quiet', '--parent-command=commit-queue', 67735]" exit_code: 1 Last 500 characters of output: .cgi?id=67735&action=edit Fetching: https://bugs.webkit.org/show_bug.cgi?id=45835&ctype=xml Processing 1 patch from 1 bug. Cleaning working directory Updating working directory Processing patch 67735 from bug 45835. NOBODY (OOPS!) found in /Projects/CommitQueue/WebCore/ChangeLog does not appear to be a valid reviewer according to committers.py. ERROR: /Projects/CommitQueue/WebCore/ChangeLog neither lists a valid reviewer nor contains the string "Unreviewed" or "Rubber stamp" (case insensitive).
Comment on attachment 67735 [details] Patch for landing Clearing flags on attachment: 67735 Committed r67641: <http://trac.webkit.org/changeset/67641>
All reviewed patches have been landed. Closing bug.