Title: [110646] trunk/Source/WebCore
- Revision
- 110646
- Author
- [email protected]
- Date
- 2012-03-13 17:18:43 -0700 (Tue, 13 Mar 2012)
Log Message
Fix potential crash when loading test results
https://bugs.webkit.org/show_bug.cgi?id=81062
<rdar://problem/11041732>
Reviewed by Dean Jackson.
If RenderLayerBacking::isSimpleContainerCompositingLayer() is called early,
before the document has a documentElement(), then it crashes. Fix with
a null check on documentElement().
No test because it's timing dependent.
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (110645 => 110646)
--- trunk/Source/WebCore/ChangeLog 2012-03-14 00:08:39 UTC (rev 110645)
+++ trunk/Source/WebCore/ChangeLog 2012-03-14 00:18:43 UTC (rev 110646)
@@ -1,3 +1,20 @@
+2012-03-13 Simon Fraser <[email protected]>
+
+ Fix potential crash when loading test results
+ https://bugs.webkit.org/show_bug.cgi?id=81062
+ <rdar://problem/11041732>
+
+ Reviewed by Dean Jackson.
+
+ If RenderLayerBacking::isSimpleContainerCompositingLayer() is called early,
+ before the document has a documentElement(), then it crashes. Fix with
+ a null check on documentElement().
+
+ No test because it's timing dependent.
+
+ * rendering/RenderLayerBacking.cpp:
+ (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+
2012-03-13 Dan Bernstein <[email protected]>
<rdar://problem/11025225> Assertion failure in RenderView::computeRectForRepaint() (!repaintContainer || repaintContainer == this) at store.apple.com
Modified: trunk/Source/WebCore/rendering/RenderLayerBacking.cpp (110645 => 110646)
--- trunk/Source/WebCore/rendering/RenderLayerBacking.cpp 2012-03-14 00:08:39 UTC (rev 110645)
+++ trunk/Source/WebCore/rendering/RenderLayerBacking.cpp 2012-03-14 00:18:43 UTC (rev 110646)
@@ -826,7 +826,7 @@
if (renderObject->node() && renderObject->node()->isDocumentNode()) {
// Look to see if the root object has a non-simple background
- RenderObject* rootObject = renderObject->document()->documentElement()->renderer();
+ RenderObject* rootObject = renderObject->document()->documentElement() ? renderObject->document()->documentElement()->renderer() : 0;
if (!rootObject)
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
