Title: [136293] trunk/Source/WebCore
- Revision
- 136293
- Author
- [email protected]
- Date
- 2012-11-30 15:56:14 -0800 (Fri, 30 Nov 2012)
Log Message
Fix potential crash when canceling animations on renderers with no node
https://bugs.webkit.org/show_bug.cgi?id=103784
Reviewed by Dan Bernstein.
We could crash when tearing down RenderScrollbars because we hit
AnimationController::cancelAnimations() for a renderer with no node.
The assertion already check for a null node, but the line after
does not, so fix that.
I tried to make a test with animations/transitions on a custom scrollbar, but was not able
to get it to crash.
* page/animation/AnimationController.cpp:
(WebCore::AnimationController::cancelAnimations):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (136292 => 136293)
--- trunk/Source/WebCore/ChangeLog 2012-11-30 23:36:49 UTC (rev 136292)
+++ trunk/Source/WebCore/ChangeLog 2012-11-30 23:56:14 UTC (rev 136293)
@@ -1,3 +1,21 @@
+2012-11-30 Simon Fraser <[email protected]>
+
+ Fix potential crash when canceling animations on renderers with no node
+ https://bugs.webkit.org/show_bug.cgi?id=103784
+
+ Reviewed by Dan Bernstein.
+
+ We could crash when tearing down RenderScrollbars because we hit
+ AnimationController::cancelAnimations() for a renderer with no node.
+ The assertion already check for a null node, but the line after
+ does not, so fix that.
+
+ I tried to make a test with animations/transitions on a custom scrollbar, but was not able
+ to get it to crash.
+
+ * page/animation/AnimationController.cpp:
+ (WebCore::AnimationController::cancelAnimations):
+
2012-11-30 Tim Horton <[email protected]>
PluginDocument fires didFinishDocumentLoadForFrame upon receiving initial bytes instead of when load completes
Modified: trunk/Source/WebCore/page/animation/AnimationController.cpp (136292 => 136293)
--- trunk/Source/WebCore/page/animation/AnimationController.cpp 2012-11-30 23:36:49 UTC (rev 136292)
+++ trunk/Source/WebCore/page/animation/AnimationController.cpp 2012-11-30 23:56:14 UTC (rev 136293)
@@ -510,7 +510,8 @@
if (m_data->clear(renderer)) {
Node* node = renderer->node();
ASSERT(!node || (node->document() && !node->document()->inPageCache()));
- node->setNeedsStyleRecalc(SyntheticStyleChange);
+ if (node)
+ node->setNeedsStyleRecalc(SyntheticStyleChange);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
