Title: [285192] trunk
- Revision
- 285192
- Author
- [email protected]
- Date
- 2021-11-02 18:47:56 -0700 (Tue, 02 Nov 2021)
Log Message
Crash in RenderLayer::rebuildZOrderLists
https://bugs.webkit.org/show_bug.cgi?id=230229
Patch by Gabriel Nava Marino <[email protected]> on 2021-11-02
Reviewed by Simon Fraser.
Source/WebCore:
Test: fast/layers/render-layer-rebuild-z-order-lists.html
To avoid operating on nullptr, allocate posZOrderList if it is null,
similar to how it is done in RenderLayer::collectLayers.
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::rebuildZOrderLists):
LayoutTests:
* fast/layers/render-layer-rebuild-z-order-lists-expected.txt: Added.
* fast/layers/render-layer-rebuild-z-order-lists.html: Added.
* platform/win/TestExpectations: Skip due to diag.showModal undefined in win.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (285191 => 285192)
--- trunk/LayoutTests/ChangeLog 2021-11-03 01:27:28 UTC (rev 285191)
+++ trunk/LayoutTests/ChangeLog 2021-11-03 01:47:56 UTC (rev 285192)
@@ -1,3 +1,14 @@
+2021-11-02 Gabriel Nava Marino <[email protected]>
+
+ Crash in RenderLayer::rebuildZOrderLists
+ https://bugs.webkit.org/show_bug.cgi?id=230229
+
+ Reviewed by Simon Fraser.
+
+ * fast/layers/render-layer-rebuild-z-order-lists-expected.txt: Added.
+ * fast/layers/render-layer-rebuild-z-order-lists.html: Added.
+ * platform/win/TestExpectations: Skip due to diag.showModal undefined in win.
+
2021-11-02 Robin Morisset <[email protected]>
Regression (r284330): [ macOS wk1 Debug ] webaudio/AudioBuffer/huge-buffer.html is a flaky timeout
Added: trunk/LayoutTests/fast/layers/render-layer-rebuild-z-order-lists-expected.txt (0 => 285192)
--- trunk/LayoutTests/fast/layers/render-layer-rebuild-z-order-lists-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/layers/render-layer-rebuild-z-order-lists-expected.txt 2021-11-03 01:47:56 UTC (rev 285192)
@@ -0,0 +1 @@
+PASS if this doesn't crash
Added: trunk/LayoutTests/fast/layers/render-layer-rebuild-z-order-lists.html (0 => 285192)
--- trunk/LayoutTests/fast/layers/render-layer-rebuild-z-order-lists.html (rev 0)
+++ trunk/LayoutTests/fast/layers/render-layer-rebuild-z-order-lists.html 2021-11-03 01:47:56 UTC (rev 285192)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+* { z-index: -1; }
+html { position: sticky; }
+</style>
+<script>
+ _onload_ = () => {
+ diag = document.getElementById('diag0');
+ diag.showModal();
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ }
+</script>
+</head>
+<body>
+<dialog id="diag0">
+PASS if this doesn't crash
+</dialog>
+</body>
+</html>
Modified: trunk/LayoutTests/platform/win/TestExpectations (285191 => 285192)
--- trunk/LayoutTests/platform/win/TestExpectations 2021-11-03 01:27:28 UTC (rev 285191)
+++ trunk/LayoutTests/platform/win/TestExpectations 2021-11-03 01:47:56 UTC (rev 285192)
@@ -3643,6 +3643,9 @@
# Only Mac has implemented DictionaryLookup
fast/layers/prevent-hit-test-during-layout.html [ Skip ]
+# Dialog showModal is disabled on Windows
+fast/layers/render-layer-rebuild-z-order-lists.html [ Skip ]
+
# webrtc not supported
imported/w3c/web-platform-tests/webrtc [ Skip ]
webrtc [ Skip ]
Modified: trunk/Source/WebCore/ChangeLog (285191 => 285192)
--- trunk/Source/WebCore/ChangeLog 2021-11-03 01:27:28 UTC (rev 285191)
+++ trunk/Source/WebCore/ChangeLog 2021-11-03 01:47:56 UTC (rev 285192)
@@ -1,3 +1,18 @@
+2021-11-02 Gabriel Nava Marino <[email protected]>
+
+ Crash in RenderLayer::rebuildZOrderLists
+ https://bugs.webkit.org/show_bug.cgi?id=230229
+
+ Reviewed by Simon Fraser.
+
+ Test: fast/layers/render-layer-rebuild-z-order-lists.html
+
+ To avoid operating on nullptr, allocate posZOrderList if it is null,
+ similar to how it is done in RenderLayer::collectLayers.
+
+ * rendering/RenderLayer.cpp:
+ (WebCore::RenderLayer::rebuildZOrderLists):
+
2021-11-02 Robin Morisset <[email protected]>
Regression (r284330): [ macOS wk1 Debug ] webaudio/AudioBuffer/huge-buffer.html is a flaky timeout
Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (285191 => 285192)
--- trunk/Source/WebCore/rendering/RenderLayer.cpp 2021-11-03 01:27:28 UTC (rev 285191)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp 2021-11-03 01:47:56 UTC (rev 285192)
@@ -794,10 +794,14 @@
auto backdropRenderer = renderer->backdropRenderer();
if (backdropRenderer && backdropRenderer->hasLayer()) {
RenderLayer* layer = backdropRenderer->layer();
+ if (!posZOrderList)
+ posZOrderList = makeUnique<Vector<RenderLayer*>>();
posZOrderList->append(layer);
}
if (renderer->hasLayer()) {
RenderLayer* layer = downcast<RenderLayerModelObject>(*renderer).layer();
+ if (!posZOrderList)
+ posZOrderList = makeUnique<Vector<RenderLayer*>>();
posZOrderList->append(layer);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
