Title: [95980] branches/chromium/835
- Revision
- 95980
- Author
- [email protected]
- Date
- 2011-09-26 12:54:16 -0700 (Mon, 26 Sep 2011)
Log Message
Merge 95074 - Crash in RenderScrollbarPart::imageChanged.
BUG=96444
Review URL: http://codereview.chromium.org/8028035
Modified Paths
Added Paths
Diff
Copied: branches/chromium/835/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt (from rev 95074, trunk/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt) (0 => 95980)
--- branches/chromium/835/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt (rev 0)
+++ branches/chromium/835/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt 2011-09-26 19:54:16 UTC (rev 95980)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+PASS
Copied: branches/chromium/835/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html (from rev 95074, trunk/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html) (0 => 95980)
--- branches/chromium/835/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html (rev 0)
+++ branches/chromium/835/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html 2011-09-26 19:54:16 UTC (rev 95980)
@@ -0,0 +1,53 @@
+<html>
+Test passes if it does not crash.
+<style>
+body
+{
+ margin: 0;
+}
+::-webkit-scrollbar {
+ -webkit-logical-height: 65536;
+ -webkit-border-image: url(does_not_exist) 0 2 0 2;
+}
+
+.inner:not(table) {
+ padding: 400px;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function showScroller()
+{
+ var scroller = document.createElement('div');
+ scroller.className = 'scroller';
+
+ var contents = document.createElement('div')
+ contents.className = 'inner';
+ scroller.appendChild(contents);
+
+ document.getElementById('container').appendChild(scroller);
+}
+
+function hideScroller()
+{
+ var scroller = document.getElementById('container').querySelectorAll('.scroller')[0];
+ scroller.parentNode.removeChild(scroller);
+}
+
+function doTest()
+{
+ if (window.eventSender) {
+ eventSender.mouseMoveTo(50, 40);
+ eventSender.mouseMoveTo(50, 55);
+ eventSender.mouseMoveTo(50, 0);
+ }
+}
+
+window.addEventListener('load', doTest, false);
+</script>
+<div id="container" _onmouseover_="showScroller()" _onmouseout_="hideScroller()">
+<p>PASS</p>
+</div>
+</html>
\ No newline at end of file
Modified: branches/chromium/835/Source/WebCore/rendering/RenderScrollbar.cpp (95979 => 95980)
--- branches/chromium/835/Source/WebCore/rendering/RenderScrollbar.cpp 2011-09-26 19:52:48 UTC (rev 95979)
+++ branches/chromium/835/Source/WebCore/rendering/RenderScrollbar.cpp 2011-09-26 19:54:16 UTC (rev 95980)
@@ -64,7 +64,15 @@
RenderScrollbar::~RenderScrollbar()
{
- ASSERT(m_parts.isEmpty());
+ if (!m_parts.isEmpty()) {
+ // When a scrollbar is detached from its parent (causing all parts removal) and
+ // ready to be destroyed, its destruction can be delayed because of RefPtr
+ // maintained in other classes such as EventHandler (m_lastScrollbarUnderMouse).
+ // Meanwhile, we can have a call to updateScrollbarPart which recreates the
+ // scrollbar part. So, we need to destroy these parts since we don't want them
+ // to call on a destroyed scrollbar. See webkit bug 68009.
+ updateScrollbarParts(true);
+ }
}
RenderBox* RenderScrollbar::owningRenderer() const
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
