[webkit-changes] [145636] branches/safari-536.30-branch

Tue, 12 Mar 2013 17:39:16 -0700

Title: [145636] branches/safari-536.30-branch

Diff

Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145635 => 145636)


--- branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 00:39:21 UTC (rev 145635)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 00:41:13 UTC (rev 145636)
@@ -1,5 +1,19 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r136558
+
+    2012-12-04  Abhishek Arya  <[email protected]>
+
+            Crash in CachedResource::checkNotify due to -webkit-crossfade.
+            https://bugs.webkit.org/show_bug.cgi?id=98068
+
+            Reviewed by Nate Chapin.
+
+            * fast/images/crossfade-client-not-removed-crash-expected.txt: Added.
+            * fast/images/crossfade-client-not-removed-crash.html: Added.
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r136541
 
     2012-12-04  Florin Malita  <[email protected]>

Copied: branches/safari-536.30-branch/LayoutTests/fast/images/crossfade-client-not-removed-crash-expected.txt (from rev 136558, trunk/LayoutTests/fast/images/crossfade-client-not-removed-crash-expected.txt) (0 => 145636)


--- branches/safari-536.30-branch/LayoutTests/fast/images/crossfade-client-not-removed-crash-expected.txt	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/images/crossfade-client-not-removed-crash-expected.txt	2013-03-13 00:41:13 UTC (rev 145636)
@@ -0,0 +1,2 @@
+Blocked access to external URL http://-4294967295/
+PASS. WebKit didn't crash.

Copied: branches/safari-536.30-branch/LayoutTests/fast/images/crossfade-client-not-removed-crash.html (from rev 136558, trunk/LayoutTests/fast/images/crossfade-client-not-removed-crash.html) (0 => 145636)


--- branches/safari-536.30-branch/LayoutTests/fast/images/crossfade-client-not-removed-crash.html	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/images/crossfade-client-not-removed-crash.html	2013-03-13 00:41:13 UTC (rev 145636)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<body id=tCF1>
+A
+<style>
+.class1 {
+    background-image: -webkit-cross-fade(url(#does-not-exist), url(http://-4294967295), 157%);
+}
+.class2:first-of-type {
+    -webkit-animation-direction: alternate;
+}
+</style>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var docElement = document.body;
+docElement.contentEditable = "true";
+
+function crash() {
+    test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "thead");
+    docElement.appendChild(test1);
+    test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "intent");
+    test2.setAttribute("class", "class2");
+    docElement.appendChild(test2);
+    test1.setAttribute("class", "class1");
+    window.getSelection().selectAllChildren(tCF1);
+    document.execCommand("hilitecolor", false, "#FF0000");
+    document.execCommand("InsertText", false, "PASS. WebKit didn't crash.");
+}
+
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>
\ No newline at end of file

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145635 => 145636)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 00:39:21 UTC (rev 145635)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 00:41:13 UTC (rev 145636)
@@ -1,5 +1,26 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r136558
+
+    2012-12-04  Abhishek Arya  <[email protected]>
+
+            Crash in CachedResource::checkNotify due to -webkit-crossfade.
+            https://bugs.webkit.org/show_bug.cgi?id=98068
+
+            Reviewed by Nate Chapin.
+
+            Make sure to not re-add the same client again for |m_cachedFromImage|
+            and |m_cachedToImage|. This would otherwise cause the CSSCrossfadeValue
+            client to not get removed from its cached image resource (when it is
+            going away).
+
+            Test: fast/images/crossfade-client-not-removed-crash.html
+
+            * css/CSSCrossfadeValue.cpp:
+            (WebCore::CSSCrossfadeValue::loadSubimages):
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r136541
 
     2012-12-04  Florin Malita  <[email protected]>

Modified: branches/safari-536.30-branch/Source/WebCore/css/CSSCrossfadeValue.cpp (145635 => 145636)


--- branches/safari-536.30-branch/Source/WebCore/css/CSSCrossfadeValue.cpp	2013-03-13 00:39:21 UTC (rev 145635)
+++ branches/safari-536.30-branch/Source/WebCore/css/CSSCrossfadeValue.cpp	2013-03-13 00:41:13 UTC (rev 145636)
@@ -123,14 +123,26 @@
 
 void CSSCrossfadeValue::loadSubimages(CachedResourceLoader* cachedResourceLoader)
 {
+    CachedResourceHandle<CachedImage> oldCachedFromImage = m_cachedFromImage;
+    CachedResourceHandle<CachedImage> oldCachedToImage = m_cachedToImage;
+
     m_cachedFromImage = cachedImageForCSSValue(m_fromValue.get(), cachedResourceLoader);
     m_cachedToImage = cachedImageForCSSValue(m_toValue.get(), cachedResourceLoader);
 
-    if (m_cachedFromImage)
-        m_cachedFromImage->addClient(&m_crossfadeSubimageObserver);
-    if (m_cachedToImage)
-        m_cachedToImage->addClient(&m_crossfadeSubimageObserver);
+    if (m_cachedFromImage != oldCachedFromImage) {
+        if (oldCachedFromImage)
+            oldCachedFromImage->removeClient(&m_crossfadeSubimageObserver);
+        if (m_cachedFromImage)
+            m_cachedFromImage->addClient(&m_crossfadeSubimageObserver);
+    }
 
+    if (m_cachedToImage != oldCachedToImage) {
+        if (oldCachedToImage)
+            oldCachedToImage->removeClient(&m_crossfadeSubimageObserver);
+        if (m_cachedToImage)
+            m_cachedToImage->addClient(&m_crossfadeSubimageObserver);
+    }
+
     m_crossfadeSubimageObserver.setReady(true);
 }
 

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to