Title: [135853] trunk
- Revision
- 135853
- Author
- [email protected]
- Date
- 2012-11-27 05:49:51 -0800 (Tue, 27 Nov 2012)
Log Message
[CSS Regions] Crash when dispatching regionlayoutupdate
https://bugs.webkit.org/show_bug.cgi?id=102944
Patch by Andrei Bucur <[email protected]> on 2012-11-27
Reviewed by Andreas Kling.
Source/WebCore:
The event dispatch function was incorrectly assuming the RenderNamedFlowThread is valid. Because the event is asynchronous it's
possible for the flow to be in the "NULL" state (the renderer is 0) while the regionlayoutupdate event is dispatched.
Test: fast/regions/webkit-named-flow-event-crash.html
* dom/WebKitNamedFlow.cpp:
(WebCore::WebKitNamedFlow::dispatchRegionLayoutUpdateEvent): Remove the ASSERT and don't dispatch the event if the flow is
in the "NULL" state.
LayoutTests:
The test modifies the layout, forces a regionlayoutupdate event to be scheduled and then removes the content and the regions.
The event is dispatched on a named flow in the "NULL" state. Without this patch a crash occurs.
* fast/regions/webkit-named-flow-event-crash-expected.txt: Added.
* fast/regions/webkit-named-flow-event-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (135852 => 135853)
--- trunk/LayoutTests/ChangeLog 2012-11-27 13:27:52 UTC (rev 135852)
+++ trunk/LayoutTests/ChangeLog 2012-11-27 13:49:51 UTC (rev 135853)
@@ -1,3 +1,16 @@
+2012-11-27 Andrei Bucur <[email protected]>
+
+ [CSS Regions] Crash when dispatching regionlayoutupdate
+ https://bugs.webkit.org/show_bug.cgi?id=102944
+
+ Reviewed by Andreas Kling.
+
+ The test modifies the layout, forces a regionlayoutupdate event to be scheduled and then removes the content and the regions.
+ The event is dispatched on a named flow in the "NULL" state. Without this patch a crash occurs.
+
+ * fast/regions/webkit-named-flow-event-crash-expected.txt: Added.
+ * fast/regions/webkit-named-flow-event-crash.html: Added.
+
2012-11-27 Allan Sandfeld Jensen <[email protected]>
Reduce XHR timeout tests execution time
Added: trunk/LayoutTests/fast/regions/webkit-named-flow-event-crash-expected.txt (0 => 135853)
--- trunk/LayoutTests/fast/regions/webkit-named-flow-event-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/regions/webkit-named-flow-event-crash-expected.txt 2012-11-27 13:49:51 UTC (rev 135853)
@@ -0,0 +1,9 @@
+Test for https://bugs.webkit.org/show_bug.cgi?id=102944 [CSS Regions] Crash when dispatching regionlayoutupdate. The test passes if there is no crash or assert.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/regions/webkit-named-flow-event-crash.html (0 => 135853)
--- trunk/LayoutTests/fast/regions/webkit-named-flow-event-crash.html (rev 0)
+++ trunk/LayoutTests/fast/regions/webkit-named-flow-event-crash.html 2012-11-27 13:49:51 UTC (rev 135853)
@@ -0,0 +1,62 @@
+<!doctype html>
+<html>
+ <head>
+ <meta charset="utf-8">
+ <script src=""
+ <style>
+ body, html {
+ width: 500px;
+ height: 500px;
+ }
+ #content {
+ width: 100%;
+ height: 100%;
+ -webkit-flow-into: flow;
+ }
+ #region {
+ width: 100%;
+ height: 100%;
+ -webkit-flow-from: flow;
+ }
+ </style>
+ </head>
+ <body>
+ <div id="content">
+ Hello crash!
+ </div>
+ <div id="region">
+ </div>
+ <script>
+ description("Test for https://bugs.webkit.org/show_bug.cgi?id=102944 [CSS Regions] Crash when dispatching regionlayoutupdate. The test passes if there is no crash or assert.");
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ function dummyHandler (evt) {
+ evt.target.removeEventListener("webkitregionlayoutupdate", dummyHandler);
+ }
+
+ setTimeout(function() {
+ var namedFlows = document.webkitGetNamedFlows();
+ namedFlows["flow"].addEventListener("webkitregionlayoutupdate", dummyHandler);
+ var content = document.getElementById("content");
+ var region = document.getElementById("region");
+ content.style.height = "600px";
+
+ // Schedule a regionlayoutupdate event.
+ document.body.offsetTop;
+
+ // Transition the flow to the "NULL" state.
+ document.body.removeChild(content);
+ document.body.removeChild(region);
+
+ setTimeout(function() {
+ if (window.testRunner)
+ testRunner.notifyDone();
+ },0)
+ }, 0);
+ </script>
+ <script src=""
+ </body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (135852 => 135853)
--- trunk/Source/WebCore/ChangeLog 2012-11-27 13:27:52 UTC (rev 135852)
+++ trunk/Source/WebCore/ChangeLog 2012-11-27 13:49:51 UTC (rev 135853)
@@ -1,3 +1,19 @@
+2012-11-27 Andrei Bucur <[email protected]>
+
+ [CSS Regions] Crash when dispatching regionlayoutupdate
+ https://bugs.webkit.org/show_bug.cgi?id=102944
+
+ Reviewed by Andreas Kling.
+
+ The event dispatch function was incorrectly assuming the RenderNamedFlowThread is valid. Because the event is asynchronous it's
+ possible for the flow to be in the "NULL" state (the renderer is 0) while the regionlayoutupdate event is dispatched.
+
+ Test: fast/regions/webkit-named-flow-event-crash.html
+
+ * dom/WebKitNamedFlow.cpp:
+ (WebCore::WebKitNamedFlow::dispatchRegionLayoutUpdateEvent): Remove the ASSERT and don't dispatch the event if the flow is
+ in the "NULL" state.
+
2012-11-27 Mihnea Ovidenie <[email protected]>
[CSS Regions] Absolutely positioned regions do not expand to fill their container
Modified: trunk/Source/WebCore/dom/WebKitNamedFlow.cpp (135852 => 135853)
--- trunk/Source/WebCore/dom/WebKitNamedFlow.cpp 2012-11-27 13:27:52 UTC (rev 135852)
+++ trunk/Source/WebCore/dom/WebKitNamedFlow.cpp 2012-11-27 13:49:51 UTC (rev 135853)
@@ -196,10 +196,13 @@
void WebKitNamedFlow::dispatchRegionLayoutUpdateEvent()
{
ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
- ASSERT(m_parentFlowThread);
- RefPtr<Event> event = UIEvent::create(eventNames().webkitregionlayoutupdateEvent, false, false, m_parentFlowThread->document()->defaultView(), 0);
+ // If the flow is in the "NULL" state the event should not be dispatched any more.
+ if (flowState() == FlowStateNull)
+ return;
+ RefPtr<Event> event = UIEvent::create(eventNames().webkitregionlayoutupdateEvent, false, false, m_flowManager->document()->defaultView(), 0);
+
dispatchEvent(event);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
