Title: [94140] branches/chromium/835/Source/WebCore
- Revision
- 94140
- Author
- [email protected]
- Date
- 2011-08-30 18:10:13 -0700 (Tue, 30 Aug 2011)
Log Message
Revert 94131 - Merge 94107
BUG=88684
Review URL: http://codereview.chromium.org/7811011
Modified Paths
Removed Paths
Diff
Deleted: branches/chromium/835/Source/WebCore/manual-tests/custom-scrollbar-renderer-removed-crash.html (94139 => 94140)
--- branches/chromium/835/Source/WebCore/manual-tests/custom-scrollbar-renderer-removed-crash.html 2011-08-31 01:09:22 UTC (rev 94139)
+++ branches/chromium/835/Source/WebCore/manual-tests/custom-scrollbar-renderer-removed-crash.html 2011-08-31 01:10:13 UTC (rev 94140)
@@ -1,11 +0,0 @@
-<html>
-<body>
-Reload page and mouse click quickly in the black box.
-<style>
-::-webkit-scrollbar { width: 1000; }
-</style>
-<script>setTimeout("try { document.body.offsetTop; child = document.body; child.parentNode.removeChild(child); } catch(e) {}", 100);</script>
-<svg>
-</svg>
-</body>
-</html>
Modified: branches/chromium/835/Source/WebCore/page/FrameView.cpp (94139 => 94140)
--- branches/chromium/835/Source/WebCore/page/FrameView.cpp 2011-08-31 01:09:22 UTC (rev 94139)
+++ branches/chromium/835/Source/WebCore/page/FrameView.cpp 2011-08-31 01:10:13 UTC (rev 94140)
@@ -2446,23 +2446,6 @@
return false;
}
-void FrameView::clearOwningRendererForCustomScrollbars(RenderBox* box)
-{
- const HashSet<RefPtr<Widget> >* viewChildren = children();
- HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
- for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
- Widget* widget = current->get();
- if (widget->isScrollbar()) {
- Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
- if (scrollbar->isCustomScrollbar()) {
- RenderScrollbar* customScrollbar = toRenderScrollbar(scrollbar);
- if (customScrollbar->owningRenderer() == box)
- customScrollbar->clearOwningRenderer();
- }
- }
- }
-}
-
FrameView* FrameView::parentFrameView() const
{
if (Widget* parentView = parent()) {
Modified: branches/chromium/835/Source/WebCore/page/FrameView.h (94139 => 94140)
--- branches/chromium/835/Source/WebCore/page/FrameView.h 2011-08-31 01:09:22 UTC (rev 94139)
+++ branches/chromium/835/Source/WebCore/page/FrameView.h 2011-08-31 01:10:13 UTC (rev 94140)
@@ -286,8 +286,6 @@
void setAnimatorsAreActive();
- void clearOwningRendererForCustomScrollbars(RenderBox*);
-
protected:
virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
virtual void scrollContentsSlowPath(const IntRect& updateRect);
Modified: branches/chromium/835/Source/WebCore/rendering/RenderBox.cpp (94139 => 94140)
--- branches/chromium/835/Source/WebCore/rendering/RenderBox.cpp 2011-08-31 01:09:22 UTC (rev 94139)
+++ branches/chromium/835/Source/WebCore/rendering/RenderBox.cpp 2011-08-31 01:10:13 UTC (rev 94140)
@@ -200,11 +200,6 @@
if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
RenderBlock::removePercentHeightDescendant(this);
- // If this renderer is owning renderer for the frameview's custom scrollbars,
- // we need to clear it from the scrollbar. See webkit bug 64737.
- if (style() && style()->hasPseudoStyle(SCROLLBAR) && frame() && frame()->view())
- frame()->view()->clearOwningRendererForCustomScrollbars(this);
-
// If the following assertion fails, logicalHeight()/logicalMinHeight()/
// logicalMaxHeight() values are changed from a percent value to a non-percent
// value during laying out. It causes a use-after-free bug.
Modified: branches/chromium/835/Source/WebCore/rendering/RenderScrollbar.cpp (94139 => 94140)
--- branches/chromium/835/Source/WebCore/rendering/RenderScrollbar.cpp 2011-08-31 01:09:22 UTC (rev 94139)
+++ branches/chromium/835/Source/WebCore/rendering/RenderScrollbar.cpp 2011-08-31 01:10:13 UTC (rev 94140)
@@ -149,7 +149,7 @@
PassRefPtr<RenderStyle> RenderScrollbar::getScrollbarPseudoStyle(ScrollbarPart partType, PseudoId pseudoId)
{
- if (!owningRenderer())
+ if (!m_owner)
return 0;
s_styleResolvePart = partType;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
