Title: [104500] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104499 => 104500)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-09 23:32:00 UTC (rev 104499)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-09 23:43:07 UTC (rev 104500)
@@ -1,5 +1,19 @@
2011-1-6 Lucas Forschler <[email protected]>
+ Merge 101091
+
+ 2011-11-23 Antti Koivisto <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=72354
+ Image pointer in FillLayer not cleared correctly
+
+ Reviewed by Dan Bernstein.
+
+ * fast/css/fill-layer-crash-expected.txt: Added.
+ * fast/css/fill-layer-crash.html: Added.
+
+2011-1-6 Lucas Forschler <[email protected]>
+
Merge 100677
2011-11-17 Ken Buchanan <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/fast/css/fill-layer-crash-expected.txt (from rev 101091, trunk/LayoutTests/fast/css/fill-layer-crash-expected.txt) (0 => 104500)
--- branches/safari-534.54-branch/LayoutTests/fast/css/fill-layer-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css/fill-layer-crash-expected.txt 2012-01-09 23:43:07 UTC (rev 104500)
@@ -0,0 +1 @@
+This test works if it doesn't crash.
Copied: branches/safari-534.54-branch/LayoutTests/fast/css/fill-layer-crash.html (from rev 101091, trunk/LayoutTests/fast/css/fill-layer-crash.html) (0 => 104500)
--- branches/safari-534.54-branch/LayoutTests/fast/css/fill-layer-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css/fill-layer-crash.html 2012-01-09 23:43:07 UTC (rev 104500)
@@ -0,0 +1,25 @@
+<html>
+<head id="head">
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<style>
+* {background-image:inherit;}
+</style>
+</head>
+<body>
+ <span></span>
+</body>
+<script>
+document.body.style.background=""
+var head = document.getElementById("head");
+style = document.createElement("style");
+style.type = "text/css";
+var rule = document.createTextNode("* {content:counter(mycount_id)}");
+style.appendChild(rule);
+head.appendChild(style);
+document.body.setAttribute("style","line-height:128mm;");
+</script>
+This test works if it doesn't crash.
+</html>
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104499 => 104500)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-09 23:32:00 UTC (rev 104499)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-09 23:43:07 UTC (rev 104500)
@@ -1,3 +1,21 @@
+2011-1-6 Lucas Forschler <[email protected]>
+
+ Merge 101091
+
+ 2011-11-23 Antti Koivisto <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=72354
+ Image pointer in FillLayer not cleared correctly
+
+ Reviewed by Dan Bernstein.
+
+ Test: fast/css/fill-layer-crash.html
+
+ We should clear the image pointer too, not just the m_imageSet bit.
+
+ * rendering/style/FillLayer.h:
+ (WebCore::FillLayer::clearImage):
+
2011-1-9 Lucas Forschler <[email protected]>
Merge 100809
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/style/FillLayer.h (104499 => 104500)
--- branches/safari-534.54-branch/Source/WebCore/rendering/style/FillLayer.h 2012-01-09 23:32:00 UTC (rev 104499)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/style/FillLayer.h 2012-01-09 23:43:07 UTC (rev 104500)
@@ -105,7 +105,7 @@
void setSizeLength(LengthSize l) { m_sizeLength = l; }
void setSize(FillSize f) { m_sizeType = f.type; m_sizeLength = f.size; }
- void clearImage() { m_imageSet = false; }
+ void clearImage() { m_image.clear(); m_imageSet = false; }
void clearXPosition() { m_xPosSet = false; }
void clearYPosition() { m_yPosSet = false; }
void clearAttachment() { m_attachmentSet = false; }
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
