Title: [126919] trunk
- Revision
- 126919
- Author
- [email protected]
- Date
- 2012-08-28 13:10:49 -0700 (Tue, 28 Aug 2012)
Log Message
Regression (r126774): Crash when scrolling after removing sticky element.
https://bugs.webkit.org/show_bug.cgi?id=95174
Reviewed by Abhishek Arya.
Source/WebCore:
RenderBox::willBeDestroyed() needs to check for both fixed and sticky
position to determine whether to remove an object from FrameView's
set of fixed objects.
Test: fast/css/sticky/remove-sticky-crash.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::willBeDestroyed):
LayoutTests:
Testcase with JS that removes a position:sticky element, then scrolls.
* fast/css/sticky/remove-sticky-crash-expected.txt: Added.
* fast/css/sticky/remove-sticky-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (126918 => 126919)
--- trunk/LayoutTests/ChangeLog 2012-08-28 20:10:07 UTC (rev 126918)
+++ trunk/LayoutTests/ChangeLog 2012-08-28 20:10:49 UTC (rev 126919)
@@ -1,3 +1,15 @@
+2012-08-28 Simon Fraser <[email protected]>
+
+ Regression (r126774): Crash when scrolling after removing sticky element.
+ https://bugs.webkit.org/show_bug.cgi?id=95174
+
+ Reviewed by Abhishek Arya.
+
+ Testcase with JS that removes a position:sticky element, then scrolls.
+
+ * fast/css/sticky/remove-sticky-crash-expected.txt: Added.
+ * fast/css/sticky/remove-sticky-crash.html: Added.
+
2012-08-28 Robert Hogan <[email protected]>
Fix up ref-tests added in r126911 to make them more port-friendly.
Added: trunk/LayoutTests/fast/css/sticky/remove-sticky-crash-expected.txt (0 => 126919)
--- trunk/LayoutTests/fast/css/sticky/remove-sticky-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/sticky/remove-sticky-crash-expected.txt 2012-08-28 20:10:49 UTC (rev 126919)
@@ -0,0 +1 @@
+This test should not crash
Property changes on: trunk/LayoutTests/fast/css/sticky/remove-sticky-crash-expected.txt
___________________________________________________________________
Added: svn:mime-type
Added: svn:keywords
Added: svn:eol-style
Added: trunk/LayoutTests/fast/css/sticky/remove-sticky-crash.html (0 => 126919)
--- trunk/LayoutTests/fast/css/sticky/remove-sticky-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/sticky/remove-sticky-crash.html 2012-08-28 20:10:49 UTC (rev 126919)
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+<style>
+ body {
+ margin: 0;
+ height: 2000px;
+ }
+
+ .box {
+ width: 200px;
+ height: 200px;
+ }
+
+ .sticky {
+ position: -webkit-sticky;
+ top: 100px;
+ background-color: green;
+ }
+</style>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ function doTest()
+ {
+ var stickyBox = document.getElementById('sticky');
+ stickyBox.parentNode.removeChild(stickyBox);
+ window.scrollTo(0, 10);
+ }
+ window.addEventListener('load', doTest, false);
+</script>
+</head>
+<body>
+ <p>This test should not crash</p>
+ <div id="sticky" class="sticky box"></div>
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/css/sticky/remove-sticky-crash.html
___________________________________________________________________
Added: svn:mime-type
Added: svn:keywords
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (126918 => 126919)
--- trunk/Source/WebCore/ChangeLog 2012-08-28 20:10:07 UTC (rev 126918)
+++ trunk/Source/WebCore/ChangeLog 2012-08-28 20:10:49 UTC (rev 126919)
@@ -1,3 +1,19 @@
+2012-08-28 Simon Fraser <[email protected]>
+
+ Regression (r126774): Crash when scrolling after removing sticky element.
+ https://bugs.webkit.org/show_bug.cgi?id=95174
+
+ Reviewed by Abhishek Arya.
+
+ RenderBox::willBeDestroyed() needs to check for both fixed and sticky
+ position to determine whether to remove an object from FrameView's
+ set of fixed objects.
+
+ Test: fast/css/sticky/remove-sticky-crash.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::willBeDestroyed):
+
2012-08-28 Caio Marcelo de Oliveira Filho <[email protected]>
Rename first/second to key/value in HashMap iterators
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (126918 => 126919)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2012-08-28 20:10:07 UTC (rev 126918)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2012-08-28 20:10:49 UTC (rev 126919)
@@ -139,7 +139,7 @@
if (RenderView* view = this->view()) {
if (FrameView* frameView = view->frameView()) {
- if (style()->position() == FixedPosition)
+ if (style()->hasViewportConstrainedPosition())
frameView->removeFixedObject(this);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
