Commit 88468bcc authored by tony@chromium.org's avatar tony@chromium.org

2010-08-26 Tony Chang <tony@chromium.org>

        Reviewed by David Hyatt.

        crash when rendering scrollbar gradient
        https://bugs.webkit.org/show_bug.cgi?id=44549

        * scrollbars/scrollbar-gradient-crash-expected.txt: Added.
        * scrollbars/scrollbar-gradient-crash.html: Added.
2010-08-26  Tony Chang  <tony@chromium.org>

        Reviewed by David Hyatt.

        crash when rendering scrollbar gradient
        https://bugs.webkit.org/show_bug.cgi?id=44549

        Test: scrollbars/scrollbar-gradient-crash.html

        * css/CSSImageGeneratorValue.cpp:
        (WebCore::CSSImageGeneratorValue::getImage): Keep this alive.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@66133 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 5daabee7
2010-08-26 Tony Chang <tony@chromium.org>
Reviewed by David Hyatt.
crash when rendering scrollbar gradient
https://bugs.webkit.org/show_bug.cgi?id=44549
* scrollbars/scrollbar-gradient-crash-expected.txt: Added.
* scrollbars/scrollbar-gradient-crash.html: Added.
2010-08-26 Ojan Vafai <ojan@chromium.org>
Reviewed by Tony Chang.
<style type="text/css">
::-webkit-scrollbar {
width: 0.8em;
height: 0.8em;
}
::-webkit-scrollbar-thumb {
background: #666 -webkit-gradient(linear, left top, right top, from(rgba(255,255,255,0.5)), color-stop(0.5, rgba(255,255,255,0.1)), color-stop(0.5, rgba(0,0,0,0)), to(rgba(0,0,0,0.01)));
}
</style>
<body>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
function test()
{
// Force a layout.
window.x = document.body.offsetTop;
var styles = document.getElementsByTagName("style");
for (var i = 0; i < styles.length; ++i)
document.head.appendChild(styles[i]);
}
document.addEventListener('DOMContentLoaded', test, false);
</script>
<div style="height: 1000px;">
This test passes if it does not crash.
</div>
</body>
2010-08-26 Tony Chang <tony@chromium.org>
Reviewed by David Hyatt.
crash when rendering scrollbar gradient
https://bugs.webkit.org/show_bug.cgi?id=44549
Test: scrollbars/scrollbar-gradient-crash.html
* css/CSSImageGeneratorValue.cpp:
(WebCore::CSSImageGeneratorValue::getImage): Keep this alive.
2010-08-26 Stephen White <senorblanco@chromium.org>
Reviewed by Kenneth Russell.
......@@ -86,6 +86,8 @@ Image* CSSImageGeneratorValue::getImage(RenderObject* renderer, const IntSize& s
SizeCountPair& sizeCount = it->second;
IntSize oldSize = sizeCount.first;
if (oldSize != size) {
// If renderer is the only client, make sure we don't delete this.
RefPtr<CSSImageGeneratorValue> protect(this);
removeClient(renderer);
addClient(renderer, size);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment