Title: [145443] branches/chromium/1410
- Revision
- 145443
- Author
- [email protected]
- Date
- 2013-03-11 17:48:27 -0700 (Mon, 11 Mar 2013)
Log Message
Merge 142760
BUG=172993
Review URL: https://codereview.chromium.org/12558011
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1410/ManualTests/scrolling-coordinator-viewport-constrained-crash.html (from rev 142760, trunk/ManualTests/scrolling-coordinator-viewport-constrained-crash.html) (0 => 145443)
--- branches/chromium/1410/ManualTests/scrolling-coordinator-viewport-constrained-crash.html (rev 0)
+++ branches/chromium/1410/ManualTests/scrolling-coordinator-viewport-constrained-crash.html 2013-03-12 00:48:27 UTC (rev 145443)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ function test()
+ {
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+ window.location.href = ""
+ }
+ </script>
+</head>
+<body _onload_="test()">
+ <!-- Tests https://bugs.webkit.org/show_bug.cgi?id=108695. Should not crash. -->
+ <div style="position: fixed"></div>
+ <div style="position: -webkit-sticky"></div>
+</body>
+</html>
Modified: branches/chromium/1410/Source/WebCore/rendering/RenderBoxModelObject.cpp (145442 => 145443)
--- branches/chromium/1410/Source/WebCore/rendering/RenderBoxModelObject.cpp 2013-03-12 00:45:33 UTC (rev 145442)
+++ branches/chromium/1410/Source/WebCore/rendering/RenderBoxModelObject.cpp 2013-03-12 00:48:27 UTC (rev 145443)
@@ -331,15 +331,6 @@
// A continuation of this RenderObject should be destroyed at subclasses.
ASSERT(!continuation());
- if (isPositioned()) {
- if (RenderView* view = this->view()) {
- if (FrameView* frameView = view->frameView()) {
- if (style()->hasViewportConstrainedPosition())
- frameView->removeViewportConstrainedObject(this);
- }
- }
- }
-
// If this is a first-letter object with a remaining text fragment then the
// entry needs to be cleared from the map.
if (firstLetterRemainingText())
Modified: branches/chromium/1410/Source/WebCore/rendering/RenderLayerModelObject.cpp (145442 => 145443)
--- branches/chromium/1410/Source/WebCore/rendering/RenderLayerModelObject.cpp 2013-03-12 00:45:33 UTC (rev 145442)
+++ branches/chromium/1410/Source/WebCore/rendering/RenderLayerModelObject.cpp 2013-03-12 00:48:27 UTC (rev 145443)
@@ -76,6 +76,16 @@
void RenderLayerModelObject::willBeDestroyed()
{
+ if (isPositioned()) {
+ // Don't use this->view() because the document's renderView has been set to 0 during destruction.
+ if (Frame* frame = this->frame()) {
+ if (FrameView* frameView = frame->view()) {
+ if (style()->hasViewportConstrainedPosition())
+ frameView->removeViewportConstrainedObject(this);
+ }
+ }
+ }
+
// RenderObject::willBeDestroyed calls back to destroyLayer() for layer destruction
RenderObject::willBeDestroyed();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
