RESOLVED FIXED 47430
REGRESSION (r66223): Crash when using CSS content and -webkit-mask-box-image properties containing cached images. 
https://bugs.webkit.org/show_bug.cgi?id=47430
Summary REGRESSION (r66223): Crash when using CSS content and -webkit-mask-box-image ...
Andy Estes
Reported 2010-10-08 14:25:21 PDT
REGRESSION (r66599): Crash when using CSS content and -webkit-mask-box-image properties containing cached images.
Attachments
Test case (383 bytes, text/html)
2010-10-08 14:30 PDT, Andy Estes 		no flags
Details
Patch (3.51 KB, patch)
2010-10-08 14:36 PDT, Andy Estes 		no flags
DetailsFormatted DiffDiff
Patch (3.55 KB, patch)
2010-10-08 14:45 PDT, Andy Estes 		darin: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Andy Estes
Comment 1 2010-10-08 14:30:55 PDT
Created attachment 70288 [details] Test case Opening this test case will cause a WebKit nightly build to crash.
Darin Adler
Comment 2 2010-10-08 14:36:13 PDT
The crash is a null pointer dereference.
Andy Estes
Comment 3 2010-10-08 14:36:33 PDT
Created attachment 70290 [details] Patch
Andy Estes
Comment 4 2010-10-08 14:37:38 PDT
<rdar://problem/8531448>
Darin Adler
Comment 5 2010-10-08 14:40:41 PDT
Comment on attachment 70290 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=70290&action=review > WebCore/rendering/RenderImage.cpp:126 > + if (!m_imageResource) > + return; This is returning too early. We want to call through to RenderReplaced::imageChanged even if m_imageResource is 0.
Andy Estes
Comment 6 2010-10-08 14:45:30 PDT
Created attachment 70294 [details] Patch
Andy Estes
Comment 7 2010-10-08 14:57:47 PDT
Committed r69423: <http://trac.webkit.org/changeset/69423>
Note You need to log in before you can comment on or make changes to this bug.