Title: [148235] branches/safari-536.30-branch
- Revision
- 148235
- Author
- [email protected]
- Date
- 2013-04-11 14:28:55 -0700 (Thu, 11 Apr 2013)
Log Message
Merged r136554. <rdar://problem/13334986>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (148234 => 148235)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-04-11 21:01:07 UTC (rev 148234)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-04-11 21:28:55 UTC (rev 148235)
@@ -1,3 +1,17 @@
+2013-04-11 Lucas Forschler <[email protected]>
+
+ Merge r136554
+
+ 2012-12-04 Julien Chaffraix <[email protected]>
+
+ Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]
+ https://bugs.webkit.org/show_bug.cgi?id=100764
+
+ Reviewed by Eric Seidel.
+
+ * mathml/mfenced-root-layer-expected.txt: Added.
+ * mathml/mfenced-root-layer.html: Added.
+
2013-04-10 Lucas Forschler <[email protected]>
Merge r136250
Copied: branches/safari-536.30-branch/LayoutTests/mathml/mfenced-root-layer-expected.txt (from rev 136554, trunk/LayoutTests/mathml/mfenced-root-layer-expected.txt) (0 => 148235)
--- branches/safari-536.30-branch/LayoutTests/mathml/mfenced-root-layer-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/mathml/mfenced-root-layer-expected.txt 2013-04-11 21:28:55 UTC (rev 148235)
@@ -0,0 +1,2 @@
+Bug 100764: Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]
+This test passes if it does not crash.
Copied: branches/safari-536.30-branch/LayoutTests/mathml/mfenced-root-layer.html (from rev 136554, trunk/LayoutTests/mathml/mfenced-root-layer.html) (0 => 148235)
--- branches/safari-536.30-branch/LayoutTests/mathml/mfenced-root-layer.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/mathml/mfenced-root-layer.html 2013-04-11 21:28:55 UTC (rev 148235)
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var mfenced = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mfenced");
+
+ var docElt = document.documentElement;
+ docElt.parentNode.removeChild(docElt);
+
+ document.appendChild(mfenced);
+
+ var e = document.createElement("div");
+ e.innerHTML = "<a href=''>Bug 100764</a>: Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]<br>This test passes if it does not crash.";
+ mfenced.appendChild(e);
+</script>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (148234 => 148235)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-04-11 21:01:07 UTC (rev 148234)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-04-11 21:28:55 UTC (rev 148235)
@@ -1,3 +1,21 @@
+2013-04-11 Lucas Forschler <[email protected]>
+
+ Merge r136554
+
+ 2012-12-04 Julien Chaffraix <[email protected]>
+
+ Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]
+ https://bugs.webkit.org/show_bug.cgi?id=100764
+
+ Reviewed by Eric Seidel.
+
+ Test: mathml/mfenced-root-layer.html
+
+ * rendering/RenderLayer.cpp:
+ (WebCore::RenderLayer::stackingContext):
+ Fixed this function to ensure that it always returns a stacking context, the bug
+ was that the document element's layer wasn't guaranteed to be a stacking context.
+
2013-04-10 Lucas Forschler <[email protected]>
Merge r136250
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderLayer.cpp (148234 => 148235)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderLayer.cpp 2013-04-11 21:01:07 UTC (rev 148234)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderLayer.cpp 2013-04-11 21:28:55 UTC (rev 148235)
@@ -895,8 +895,10 @@
RenderLayer* RenderLayer::stackingContext() const
{
RenderLayer* layer = parent();
- while (layer && !layer->renderer()->isRenderView() && !layer->renderer()->isRoot() && layer->renderer()->style()->hasAutoZIndex())
+ while (layer && !layer->isStackingContext())
layer = layer->parent();
+
+ ASSERT(!layer || layer->isStackingContext());
return layer;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
