projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: f8dbe7f)
Source/WebCore: Crash in FrameView::forceLayoutParentViewIfNeeded.
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jan 2012 10:00:20 +0000 (10:00 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jan 2012 10:00:20 +0000 (10:00 +0000)
https://bugs.webkit.org/show_bug.cgi?id=76309

Reviewed by Nikolas Zimmermann.

updateWidgetPositions can blow away the owning renderer
and its frameview, so need to protect it with refptr.

Test: svg/dom/parent-view-layout-crash.html

* page/FrameView.cpp:
(WebCore::FrameView::forceLayoutParentViewIfNeeded):

LayoutTests: Crash in FrameView::forceLayoutParentViewIfNeeded.
https://bugs.webkit.org/show_bug.cgi?id=76309

Reviewed by Nikolas Zimmermann.

* svg/dom/parent-view-layout-crash-expected.txt: Added.
* svg/dom/parent-view-layout-crash.html: Added.
* svg/dom/resources/svg-font-face.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105250 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/svg/dom/parent-view-layout-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/svg/dom/parent-view-layout-crash.html [new file with mode: 0644] patch | blob
LayoutTests/svg/dom/resources/svg-font-face.svg [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/page/FrameView.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 8676d67..130f1bd 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2012-01-18  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in FrameView::forceLayoutParentViewIfNeeded.
+        https://bugs.webkit.org/show_bug.cgi?id=76309
+
+        Reviewed by Nikolas Zimmermann.
+
+        * svg/dom/parent-view-layout-crash-expected.txt: Added.
+        * svg/dom/parent-view-layout-crash.html: Added.
+        * svg/dom/resources/svg-font-face.svg: Added.
+
 2012-01-18  Shinya Kawanaka  <shinyak@google.com>
 
         Move ShadowContentElement from dom/ to html/ and make ShadowContentElement subclass of HTMLElement.
diff --git a/LayoutTests/svg/dom/parent-view-layout-crash-expected.txt b/LayoutTests/svg/dom/parent-view-layout-crash-expected.txt
new file mode 100644 (file)
index 0000000..630c83f
--- /dev/null
+++ b/LayoutTests/svg/dom/parent-view-layout-crash-expected.txt
@@ -0,0 +1 @@
+Test passes if it does not crash.  
diff --git a/LayoutTests/svg/dom/parent-view-layout-crash.html b/LayoutTests/svg/dom/parent-view-layout-crash.html
new file mode 100644 (file)
index 0000000..e28f3d4
--- /dev/null
+++ b/LayoutTests/svg/dom/parent-view-layout-crash.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>\r
+<html>\r
+Test passes if it does not crash.\r
+<style></style>\r
+<script>\r
+if (window.layoutTestController)\r
+    layoutTestController.dumpAsText();\r
+\r
+function runTest()\r
+{\r
+    document.styleSheets[0].insertRule("font {}", 0);\r
+}\r
+</script>\r
+<object data="resources/svg-font-face.svg"></object>\r
+<object style="content:counter(item)" data="resources/svg-font-face.svg" onload="runTest()"></object>\r
+</script>\r
+</html>\r
+\r
diff --git a/LayoutTests/svg/dom/resources/svg-font-face.svg b/LayoutTests/svg/dom/resources/svg-font-face.svg
new file mode 100644 (file)
index 0000000..471d80a
--- /dev/null
+++ b/LayoutTests/svg/dom/resources/svg-font-face.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">\r
+    <font-face-uri xlink:href=""/>\r
+</svg>\r
+\r
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 43bbd95..d73ffa3 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2012-01-18  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in FrameView::forceLayoutParentViewIfNeeded.        
+        https://bugs.webkit.org/show_bug.cgi?id=76309
+
+        Reviewed by Nikolas Zimmermann.
+
+        updateWidgetPositions can blow away the owning renderer
+        and its frameview, so need to protect it with refptr.
+
+        Test: svg/dom/parent-view-layout-crash.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayoutParentViewIfNeeded):
+
 2012-01-18  Shinya Kawanaka  <shinyak@google.com>
 
         Move ShadowContentElement from dom/ to html/ and make ShadowContentElement subclass of HTMLElement.
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 17c9dec..21948f3 100644 (file)
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -915,6 +915,8 @@ inline void FrameView::forceLayoutParentViewIfNeeded()
     if (!svgRoot->needsSizeNegotiationWithHostDocument())
         return;
 
+    RefPtr<FrameView> frameView = ownerRenderer->frame()->view();
+
     ASSERT(!m_inLayoutParentView);
     TemporaryChange<bool> resetInLayoutParentView(m_inLayoutParentView, true);
 
@@ -933,7 +935,6 @@ inline void FrameView::forceLayoutParentViewIfNeeded()
     rootView->updateWidgetPositions();
 
     // Synchronously enter layout, to layout the view containing the host object/embed/iframe.
-    FrameView* frameView = ownerRenderer->frame()->view();
     ASSERT(frameView);
     frameView->layout();
 #endif
Domain: Web Framework / Uncategorized;