Title: [120662] trunk
- Revision
- 120662
- Author
- [email protected]
- Date
- 2012-06-18 20:20:53 -0700 (Mon, 18 Jun 2012)
Log Message
Crash when setting title dynamically
https://bugs.webkit.org/show_bug.cgi?id=88083
Reviewed by Dan Bernstein.
Source/WebCore:
Test: fast/text/title-crash.html
The crashing code takes a rare branch in StyleResolver::styleForElement() where
m_parentStyle is set to point to m_style. Consequently, while applying properties
to m_style we end up mutating m_parentStyle.
In this situation, we clone style() and point m_parentStyle at the clone. The
clone is destroyed at the end of StyleResolver::styleForElement().
* css/StyleResolver.cpp:
(WebCore::StyleResolver::collectMatchingRulesForList):
LayoutTests:
* fast/text/title-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (120661 => 120662)
--- trunk/LayoutTests/ChangeLog 2012-06-19 03:04:50 UTC (rev 120661)
+++ trunk/LayoutTests/ChangeLog 2012-06-19 03:20:53 UTC (rev 120662)
@@ -1,3 +1,12 @@
+2012-06-18 Mike Lawther <[email protected]>
+
+ Crash when setting title dynamically
+ https://bugs.webkit.org/show_bug.cgi?id=88083
+
+ Reviewed by Dan Bernstein.
+
+ * fast/text/title-crash.html: Added.
+
2012-06-18 Adrienne Walker <[email protected]>
RenderLayerBacking sometimes doesn't attach scrollbars to graphics layer tree
Added: trunk/LayoutTests/fast/text/title-crash.html (0 => 120662)
--- trunk/LayoutTests/fast/text/title-crash.html (rev 0)
+++ trunk/LayoutTests/fast/text/title-crash.html 2012-06-19 03:20:53 UTC (rev 120662)
@@ -0,0 +1,6 @@
+<style>*{font-style:italic;font-size:1ex;}</style>
+<script>
+ if (window.layoutTestController)
+ window.layoutTestController.dumpAsText();
+ document.documentElement.innerHTML = '<title>a</title>This test passes if it does not crash.'
+</script>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (120661 => 120662)
--- trunk/Source/WebCore/ChangeLog 2012-06-19 03:04:50 UTC (rev 120661)
+++ trunk/Source/WebCore/ChangeLog 2012-06-19 03:20:53 UTC (rev 120662)
@@ -1,3 +1,22 @@
+2012-06-18 Mike Lawther <[email protected]>
+
+ Crash when setting title dynamically
+ https://bugs.webkit.org/show_bug.cgi?id=88083
+
+ Reviewed by Dan Bernstein.
+
+ Test: fast/text/title-crash.html
+
+ The crashing code takes a rare branch in StyleResolver::styleForElement() where
+ m_parentStyle is set to point to m_style. Consequently, while applying properties
+ to m_style we end up mutating m_parentStyle.
+
+ In this situation, we clone style() and point m_parentStyle at the clone. The
+ clone is destroyed at the end of StyleResolver::styleForElement().
+
+ * css/StyleResolver.cpp:
+ (WebCore::StyleResolver::collectMatchingRulesForList):
+
2012-06-18 Adrienne Walker <[email protected]>
RenderLayerBacking sometimes doesn't attach scrollbars to graphics layer tree
Modified: trunk/Source/WebCore/css/StyleResolver.cpp (120661 => 120662)
--- trunk/Source/WebCore/css/StyleResolver.cpp 2012-06-19 03:04:50 UTC (rev 120661)
+++ trunk/Source/WebCore/css/StyleResolver.cpp 2012-06-19 03:20:53 UTC (rev 120662)
@@ -1657,16 +1657,19 @@
m_style = RenderStyle::create();
+ RefPtr<RenderStyle> cloneForParent;
+
if (m_parentStyle)
m_style->inheritFrom(m_parentStyle, isAtShadowBoundary(element) ? RenderStyle::AtShadowBoundary : RenderStyle::NotAtShadowBoundary);
else {
- m_parentStyle = style();
// Make sure our fonts are initialized if we don't inherit them from our parent style.
if (Settings* settings = documentSettings()) {
initializeFontStyle(settings);
m_style->font().update(fontSelector());
} else
m_style->font().update(0);
+ cloneForParent = RenderStyle::clone(style());
+ m_parentStyle = cloneForParent.get();
}
if (element->isLink()) {
@@ -1689,6 +1692,9 @@
initElement(0); // Clear out for the next resolve.
+ if (cloneForParent)
+ m_parentStyle = 0;
+
// Now return the style.
return m_style.release();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
