Reviewed by Darin Adler.
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 8 Nov 2007 01:54:14 +0000 (01:54 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 8 Nov 2007 01:54:14 +0000 (01:54 +0000)
commit0e405175a357b6d1f0a184d6145dc8b529738a33
treed3928d92bd295e0c557d8412ed35926a87731218
parenta8b295eaf844ca66cf2063216ca9b0ad4a05a04c
    Reviewed by Darin Adler.

        - fix <rdar://problem/5523503> Safari crashes clicking scroll bar in FaceBook 'Trips'

        Layers and listboxes are two kinds of ScrollBarClient that can be
        removed while the scrollbar is tracking the mouse. The scrollbar is not
        destroyed until later, and meanwhile it can try to call the client,
        which results in a crash.

        * manual-tests/stale-scrollbar-client-crash.html: Added.
        * platform/ScrollBar.h:
        (WebCore::Scrollbar::setClient): Added.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::destroyScrollbar): Call Scrollbar::setClient().
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::~RenderListBox): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27585 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore/ChangeLog
WebCore/manual-tests/stale-scrollbar-client-crash.html [new file with mode: 0644]
WebCore/platform/ScrollBar.h
WebCore/rendering/RenderLayer.cpp
WebCore/rendering/RenderListBox.cpp