Bad cast in RenderBox::computeReplacedLogicalHeightUsing
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 14 Aug 2012 00:11:35 +0000 (00:11 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 14 Aug 2012 00:11:35 +0000 (00:11 +0000)
commit4e99e5c626a32321225413c0d48971785de0372a
treebe878015e226f4c9408af339c4dac36575d34397
parent990c774584ebe784e16ab1db4e5176d14ec2fef5
Bad cast in RenderBox::computeReplacedLogicalHeightUsing
https://bugs.webkit.org/show_bug.cgi?id=93875

Patch by Pravin D <pravind.2k4@gmail.com> on 2012-08-13
Reviewed by Abhishek Arya.

Source/WebCore:

Pointer to the container of a replaced element was being type casted to renderbox
without checking if the container is a renderbox or not.

Test: fast/replaced/render-inline-cast-to-render-box-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeReplacedLogicalHeightUsing):
 Scrollbar height is retrieved only if the container is a renderBox. Otherwise scrollbar is taken as zero.

LayoutTests:

* fast/replaced/render-inline-cast-to-render-box-crash-expected.txt: Added.
* fast/replaced/render-inline-cast-to-render-box-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@125472 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBox.cpp