Fix crash with toDataURL to JPEG
Created attachment 110236 [details] Patch
Comment on attachment 110236 [details] Patch Can we make a test case to cover this?
Comment on attachment 110236 [details] Patch Rejecting attachment 110236 [details] from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2 Last 500 characters of output: 381db9f538a72509ddceba74bc8fa72d7ba8a196 r96996 = 597be029117bbf6b1591194e17018dff0ce3fbd4 Done rebuilding .git/svn/refs/remotes/origin/master/.rev_map.268f45cc-cd09-0410-ab3c-d52691b4dbfc First, rewinding head to replay your work on top of it... Fast-forwarded master to refs/remotes/origin/master. Updating chromium port dependencies using gclient... ________ running '/usr/bin/python gyp_webkit' in '/mnt/git/webkit-commit-queue/Source/WebKit/chromium' Updating webkit projects from gyp files... Full output: http://queues.webkit.org/results/9995417
Created attachment 110439 [details] Patch
Comment on attachment 110439 [details] Patch Rejecting attachment 110439 [details] from commit-queue. jbauman@chromium.org does not have committer permissions according to http://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/committers.py. - If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have committer rights please correct the error in Tools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your committer rights.
Comment on attachment 110439 [details] Patch Looks good. r=me
Comment on attachment 110439 [details] Patch Clearing flags on attachment: 110439 Committed r97132: <http://trac.webkit.org/changeset/97132>
All reviewed patches have been landed. Closing bug.
This looks like a use after free bug. Can you please confirm soon so that we can merge to m15 ? Do you have a crash id or crash stack ??
This is a use after free, but it's not in M15 - it was introduced in r96000.
(In reply to comment #2) > Can we make a test case to cover this? I reproduced with http://persistent.info/chromium/test-cases/canvas-crash.html, filed bug 69991 about creating a test case.