Title: [104054] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104053 => 104054)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 19:38:42 UTC (rev 104053)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 19:42:18 UTC (rev 104054)
@@ -1,5 +1,19 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95074
+
+ 2011-09-13 Abhishek Arya <[email protected]>
+
+ Crash in RenderScrollbarPart::imageChanged.
+ https://bugs.webkit.org/show_bug.cgi?id=68009
+
+ Reviewed by Simon Fraser.
+
+ * scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt: Added.
+ * scrollbars/scrollbar-part-created-with-no-parent-crash.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95071
2011-09-13 Adam Klein <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt (from rev 95074, trunk/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt) (0 => 104054)
--- branches/safari-534.54-branch/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt 2012-01-04 19:42:18 UTC (rev 104054)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+PASS
Copied: branches/safari-534.54-branch/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html (from rev 95074, trunk/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html) (0 => 104054)
--- branches/safari-534.54-branch/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html 2012-01-04 19:42:18 UTC (rev 104054)
@@ -0,0 +1,53 @@
+<html>
+Test passes if it does not crash.
+<style>
+body
+{
+ margin: 0;
+}
+::-webkit-scrollbar {
+ -webkit-logical-height: 65536;
+ -webkit-border-image: url(does_not_exist) 0 2 0 2;
+}
+
+.inner:not(table) {
+ padding: 400px;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function showScroller()
+{
+ var scroller = document.createElement('div');
+ scroller.className = 'scroller';
+
+ var contents = document.createElement('div')
+ contents.className = 'inner';
+ scroller.appendChild(contents);
+
+ document.getElementById('container').appendChild(scroller);
+}
+
+function hideScroller()
+{
+ var scroller = document.getElementById('container').querySelectorAll('.scroller')[0];
+ scroller.parentNode.removeChild(scroller);
+}
+
+function doTest()
+{
+ if (window.eventSender) {
+ eventSender.mouseMoveTo(50, 40);
+ eventSender.mouseMoveTo(50, 55);
+ eventSender.mouseMoveTo(50, 0);
+ }
+}
+
+window.addEventListener('load', doTest, false);
+</script>
+<div id="container" _onmouseover_="showScroller()" _onmouseout_="hideScroller()">
+<p>PASS</p>
+</div>
+</html>
\ No newline at end of file
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104053 => 104054)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 19:38:42 UTC (rev 104053)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 19:42:18 UTC (rev 104054)
@@ -1,5 +1,29 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95074
+
+ 2011-09-13 Abhishek Arya <[email protected]>
+
+ Crash in RenderScrollbarPart::imageChanged.
+ https://bugs.webkit.org/show_bug.cgi?id=68009
+
+ Reviewed by Simon Fraser.
+
+ When a custom scrollbar is removed from its FrameView, its destruction
+ can be delayed because of RefPtr maintained in EventHandler class
+ (m_lastScrollbarUnderMouse). Upon removal, we delete all the scrollbar
+ parts so that they don't link back to scrollbar. However, because of the
+ delay, we can have a call to updateScrollbarPart which recreates it.
+ When scrollbar is getting destroyed, we just check to see if there are
+ remaining scrollbar parts and if yes, we destroy them.
+
+ Test: scrollbars/scrollbar-part-created-with-no-parent-crash.html
+
+ * rendering/RenderScrollbar.cpp:
+ (WebCore::RenderScrollbar::~RenderScrollbar):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95071
2011-09-13 Adam Klein <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderScrollbar.cpp (104053 => 104054)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderScrollbar.cpp 2012-01-04 19:38:42 UTC (rev 104053)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderScrollbar.cpp 2012-01-04 19:42:18 UTC (rev 104054)
@@ -64,7 +64,15 @@
RenderScrollbar::~RenderScrollbar()
{
- ASSERT(m_parts.isEmpty());
+ if (!m_parts.isEmpty()) {
+ // When a scrollbar is detached from its parent (causing all parts removal) and
+ // ready to be destroyed, its destruction can be delayed because of RefPtr
+ // maintained in other classes such as EventHandler (m_lastScrollbarUnderMouse).
+ // Meanwhile, we can have a call to updateScrollbarPart which recreates the
+ // scrollbar part. So, we need to destroy these parts since we don't want them
+ // to call on a destroyed scrollbar. See webkit bug 68009.
+ updateScrollbarParts(true);
+ }
}
RenderBox* RenderScrollbar::owningRenderer() const
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
