Title: [131763] branches/chromium/1271
- Revision
- 131763
- Author
- [email protected]
- Date
- 2012-10-18 09:55:46 -0700 (Thu, 18 Oct 2012)
Log Message
Merge 129962 - REGRESSION(r122215) - CachedImage::likelyToBeUsedSoon crashes on accessing a deleted CachedImageClient
BUG=151424
Review URL: https://codereview.chromium.org/11194057
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1271/ManualTests/drag-image-no-crash.html (from rev 129962, trunk/ManualTests/drag-image-no-crash.html) (0 => 131763)
--- branches/chromium/1271/ManualTests/drag-image-no-crash.html (rev 0)
+++ branches/chromium/1271/ManualTests/drag-image-no-crash.html 2012-10-18 16:55:46 UTC (rev 131763)
@@ -0,0 +1,87 @@
+<html>
+<body>
+<script>
+// This is a 10x10 24-bits RGB BMP image in white.
+var imageString =
+"Qk12AQAAAAAAADYAAAAoAAAACgAAAAoAAAABABgAAAAAAEABAAATCwAAEwsAAAAAAAAAAAAAAAAA" +
+"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" +
+"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" +
+"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" +
+"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" +
+"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" +
+"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+
+// Raw image byets.
+var imageRaw = window.atob(imageString).split("");
+
+// 10x10x3 bytes are image data.
+var pixelBytes = 300;
+var beginByte = imageRaw.length - pixelBytes;
+
+function generateNewImage()
+{
+ // Add 1 to image data.
+ for (var i = beginByte; i < imageRaw.length; ++i) {
+ var c = imageRaw[i].charCodeAt(0);
+ if (c == 255) {
+ imageRaw[i] = String.fromCharCode(0);
+ } else {
+ imageRaw[i] = String.fromCharCode(c+1);
+ break;
+ }
+ }
+
+ var bmpImage = new Image();
+ bmpImage.src = "" + window.btoa(imageRaw.join(""));
+ return bmpImage;
+}
+
+var imageCount = 0;
+function addImage()
+{
+ if (imageCount >= 1000 * 1000)
+ return;
+ document.getElementById("imageCanvas").appendChild(generateNewImage());
+ window.setTimeout("addImage()", 1);
+}
+
+function runTest()
+{
+ document.getElementById("dragFrame").contentWindow.location.href =
+ "about:blank";
+ addImage();
+}
+</script>
+<p>To run this test:</p>
+<p>1. Drag this text 10 times:
+ <iframe id="dragFrame" width="50" height="30">.</iframe></p>
+<p>2. Click this <button _onclick_="runTest();">Start</button> button.</p>
+<p>3. Let it run for 5 minutes and browser shouldn't crash.</p>
+<div id="imageCanvas"></div>
+
+<script>
+// Write this content to the iframe.
+var content =
+ "<" + "body" + ">" +
+ "<" + "script" + ">" +
+ "function dragStartHandler()" +
+ "{" +
+ " var img = new Image();" +
+ " img.src = '';" +
+ " event.dataTransfer.setDragImage(img, 10, 10);" +
+ "}" +
+ "</" + "script" + ">" +
+ "<span _ondragstart_='dragStartHandler()'" +
+ " style='-webkit-user-select:none;" +
+ " -webkit-user-drag: element;" +
+ " position: absolute; top: 0; left: 0;" +
+ " background-color: blue;'>HERE</span>" +
+ "</" + "body" + ">";
+
+var doc = document.getElementById("dragFrame");
+doc.contentDocument.open();
+doc.contentDocument.write(content);
+doc.contentDocument.close();
+</script>
+</body>
+</html>
Modified: branches/chromium/1271/Source/WebCore/platform/chromium/ClipboardChromium.cpp (131762 => 131763)
--- branches/chromium/1271/Source/WebCore/platform/chromium/ClipboardChromium.cpp 2012-10-18 16:53:15 UTC (rev 131762)
+++ branches/chromium/1271/Source/WebCore/platform/chromium/ClipboardChromium.cpp 2012-10-18 16:55:46 UTC (rev 131763)
@@ -227,6 +227,8 @@
ClipboardChromium::~ClipboardChromium()
{
+ if (m_dragImage)
+ m_dragImage->removeClient(this);
}
PassRefPtr<ClipboardChromium> ClipboardChromium::create(ClipboardType clipboardType,
Modified: branches/chromium/1271/Source/WebCore/platform/mac/ClipboardMac.mm (131762 => 131763)
--- branches/chromium/1271/Source/WebCore/platform/mac/ClipboardMac.mm 2012-10-18 16:53:15 UTC (rev 131762)
+++ branches/chromium/1271/Source/WebCore/platform/mac/ClipboardMac.mm 2012-10-18 16:55:46 UTC (rev 131763)
@@ -65,6 +65,8 @@
ClipboardMac::~ClipboardMac()
{
+ if (m_dragImage)
+ m_dragImage->removeClient(this);
}
bool ClipboardMac::hasData()
Modified: branches/chromium/1271/Source/WebCore/platform/win/ClipboardWin.cpp (131762 => 131763)
--- branches/chromium/1271/Source/WebCore/platform/win/ClipboardWin.cpp 2012-10-18 16:53:15 UTC (rev 131762)
+++ branches/chromium/1271/Source/WebCore/platform/win/ClipboardWin.cpp 2012-10-18 16:55:46 UTC (rev 131763)
@@ -355,6 +355,8 @@
ClipboardWin::~ClipboardWin()
{
+ if (m_dragImage)
+ m_dragImage->removeClient(this);
}
static bool writeURL(WCDataObject *data, const KURL& url, String title, bool withPlainText, bool withHTML)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
