Crash when encountering <object style="resize:both;">
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Feb 2013 21:36:34 +0000 (21:36 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Feb 2013 21:36:34 +0000 (21:36 +0000)
https://bugs.webkit.org/show_bug.cgi?id=109728

Source/WebCore:

See also https://code.google.com/p/chromium/issues/detail?id=175535
This bug can be reproduced on
http://dramalink.net/tudou.y/?xink=162601060

Patch by Christian Biesinger <cbiesinger@chromium.org> on 2013-02-13
Reviewed by Eric Seidel.

Test: fast/css/resize-object-crash.html

* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::paint):
Only call paintResizer() if we have a layer and canResize() is true

LayoutTests:

See also https://code.google.com/p/chromium/issues/detail?id=175535

Patch by Christian Biesinger <cbiesinger@chromium.org> on 2013-02-13
Reviewed by Eric Seidel.

* fast/css/resize-object-crash-expected.txt: Added.
* fast/css/resize-object-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@142788 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css/resize-object-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/resize-object-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderWidget.cpp

index 86a5084e567a432d2a96ddef4d32a18bbc19f5a1..2563e30f9b20bb729b230a3acb9192d7475a29be 100644 (file)
@@ -1,3 +1,15 @@
+2013-02-13  Christian Biesinger  <cbiesinger@chromium.org>
+
+        Crash when encountering <object style="resize:both;">
+        https://bugs.webkit.org/show_bug.cgi?id=109728
+
+        See also https://code.google.com/p/chromium/issues/detail?id=175535
+
+        Reviewed by Eric Seidel.
+
+        * fast/css/resize-object-crash-expected.txt: Added.
+        * fast/css/resize-object-crash.html: Added.
+
 2013-02-13  Kondapally Kalyan  <kalyan.kondapally@intel.com>
 
         [WebGL][EFL][GTK][Qt]Add support for OES_vertex_array_object.
diff --git a/LayoutTests/fast/css/resize-object-crash-expected.txt b/LayoutTests/fast/css/resize-object-crash-expected.txt
new file mode 100644 (file)
index 0000000..aa44e7c
--- /dev/null
@@ -0,0 +1,2 @@
+
+PASS
diff --git a/LayoutTests/fast/css/resize-object-crash.html b/LayoutTests/fast/css/resize-object-crash.html
new file mode 100644 (file)
index 0000000..7a6c94b
--- /dev/null
@@ -0,0 +1,21 @@
+<html>
+<head>
+    <title></title>
+    <script>
+        if (window.testRunner) {
+            testRunner.dumpAsText();
+        }
+    </script>
+    <style>
+        object {
+            resize: both !important;
+        }
+    </style>
+</head>
+<body>
+    <!--
+    Test for https://crbug.com/175535 - Crash with <object style="resize:both">
+    -->
+    <object></object><br>
+    PASS
+</body>
index cca06deeb90215c6e2998f633cbc8f83411278ee..1fb8d4bb4c1b1559fbdb750e0ef7912a9c2028b1 100644 (file)
@@ -1,3 +1,20 @@
+2013-02-13  Christian Biesinger  <cbiesinger@chromium.org>
+
+        Crash when encountering <object style="resize:both;">
+        https://bugs.webkit.org/show_bug.cgi?id=109728
+
+        See also https://code.google.com/p/chromium/issues/detail?id=175535
+        This bug can be reproduced on
+        http://dramalink.net/tudou.y/?xink=162601060
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/css/resize-object-crash.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        Only call paintResizer() if we have a layer and canResize() is true
+
 2013-02-13  Arko Saha  <arko@motorola.com>
 
         [Microdata] HTMLPropertiesCollection code cleanup
index 09d5441fcea3633e3095bdab9e24d1e85000dc0b..e08017e0858aacaa72ec97d78d5f078665286c90 100644 (file)
@@ -312,7 +312,7 @@ void RenderWidget::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
         paintInfo.context->fillRect(pixelSnappedIntRect(selectionRect()), selectionBackgroundColor(), style()->colorSpace());
     }
 
-    if (style()->resize() != RESIZE_NONE)
+    if (hasLayer() && layer()->canResize())
         layer()->paintResizer(paintInfo.context, roundedIntPoint(adjustedPaintOffset), paintInfo.rect);
 }