X-Git-Url: https://git.webkit.org/?p=WebKit-https.git;a=blobdiff_plain;f=Source%2FWebCore%2FChangeLog;h=1fb8d4bb4c1b1559fbdb750e0ef7912a9c2028b1;hp=cca06deeb90215c6e2998f633cbc8f83411278ee;hb=9eb7c57cbf807d047693544d0f2ba748afaf300b;hpb=bf465f8fee3540060bda73e83157206077d4e8a9

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index cca06deeb902..1fb8d4bb4c1b 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2013-02-13  Christian Biesinger  <cbiesinger@chromium.org>
+
+        Crash when encountering <object style="resize:both;">
+        https://bugs.webkit.org/show_bug.cgi?id=109728
+
+        See also https://code.google.com/p/chromium/issues/detail?id=175535
+        This bug can be reproduced on
+        http://dramalink.net/tudou.y/?xink=162601060
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/css/resize-object-crash.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        Only call paintResizer() if we have a layer and canResize() is true
+
 2013-02-13  Arko Saha  <arko@motorola.com>
 
         [Microdata] HTMLPropertiesCollection code cleanup