Reviewed by Maciej.

        - Fix for <rdar://problem/4707489> After timers fix, crash below RenderLayer::autoscroll after moving/destroying active <input type="text">
          and <rdar://problem/4707519> After timers fix, crash below RenderLayer::autoscroll after moving/destroying active textarea

        * rendering/RenderLayer.cpp: (WebCore::RenderLayer::~RenderLayer): If the renderer is being autoscrolled, then stop the autoscroll timer.
        * rendering/RenderListBox.cpp: (WebCore::RenderListBox::~RenderListBox): ditto.

        * page/Frame.cpp: Added getter and setter for the renderer being autoscrolled.
        (WebCore::Frame::handleAutoscroll):
        (WebCore::Frame::autoscrollTimerFired):
        (WebCore::Frame::autoscrollRenderer):
        (WebCore::Frame::setAutoscrollRenderer):
        (WebCore::Frame::stopAutoscrollTimer):
        * page/Frame.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@16833 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 17db8884d0c970abcb704aa010f3cbeba3e15325..9fee83b419f973ff7f1fff7ede88d70fabdbff6e 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,21 @@
+2006-10-05  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Maciej.
+
+        - Fix for <rdar://problem/4707489> After timers fix, crash below RenderLayer::autoscroll after moving/destroying active <input type="text">
+          and <rdar://problem/4707519> After timers fix, crash below RenderLayer::autoscroll after moving/destroying active textarea
+
+        * rendering/RenderLayer.cpp: (WebCore::RenderLayer::~RenderLayer): If the renderer is being autoscrolled, then stop the autoscroll timer.
+        * rendering/RenderListBox.cpp: (WebCore::RenderListBox::~RenderListBox): ditto.
+
+        * page/Frame.cpp: Added getter and setter for the renderer being autoscrolled.
+        (WebCore::Frame::handleAutoscroll):
+        (WebCore::Frame::autoscrollTimerFired):
+        (WebCore::Frame::autoscrollRenderer):
+        (WebCore::Frame::setAutoscrollRenderer):
+        (WebCore::Frame::stopAutoscrollTimer):
+        * page/Frame.h:
+
 2006-10-05  Don Gibson  <dgibson77@gmail.com>
 
         Reviewed by Eric.

diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index bd14bd7571fee97198ec8a837c05abd60488aec1..b090dc44f43b1775a470d6835e458ae0e903a6f3 100644 (file)
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -2858,7 +2858,7 @@ void Frame::handleAutoscroll(RenderObject* renderer)
 {
     if (d->m_autoscrollTimer.isActive())
         return;
-    d->m_autoscrollRenderer = renderer;
+    setAutoscrollRenderer(renderer);
     startAutoscrollTimer();
 }
 
@@ -2868,11 +2868,21 @@ void Frame::autoscrollTimerFired(Timer<Frame>*)
         stopAutoscrollTimer();
         return;
     }
-    if (d->m_autoscrollRenderer) {
-        d->m_autoscrollRenderer->autoscroll();
+    if (RenderObject* r = autoscrollRenderer()) {
+        r->autoscroll();
     } 
 }
 
+RenderObject* Frame::autoscrollRenderer() const
+{
+    return d->m_autoscrollRenderer;
+}
+
+void Frame::setAutoscrollRenderer(RenderObject* renderer)
+{
+    d->m_autoscrollRenderer = renderer;
+}
+
 RenderObject::NodeInfo Frame::nodeInfoAtPoint(const IntPoint& point, bool allowShadowContent)
 {
     RenderObject::NodeInfo nodeInfo(true, true);
@@ -2934,7 +2944,7 @@ void Frame::startAutoscrollTimer()
 
 void Frame::stopAutoscrollTimer()
 {
-    d->m_autoscrollRenderer = 0;
+    setAutoscrollRenderer(0);
     d->m_autoscrollTimer.stop();
 }
 

diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index 03b2af2ec92093ceedce3b7ad0be8b4f2c2dda62..43b5babc0b14f68a8fc7d563e666a7efef0cefa9 100644 (file)
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -743,9 +743,12 @@ private:
   
   void replaceContentsWithScriptResult(const KURL& url);
 
-    void disconnectOwnerElement();
+  void disconnectOwnerElement();
 
-    void setNeedsReapplyStyles();
+  void setNeedsReapplyStyles();
+
+  void stopAutoscrollTimer();
+  RenderObject* autoscrollRenderer() const;
 
 protected:
     virtual void startRedirectionTimer();
@@ -755,7 +758,7 @@ protected:
     
     void handleAutoscroll(RenderObject*);
     void startAutoscrollTimer();
-    void stopAutoscrollTimer();
+    void setAutoscrollRenderer(RenderObject*);
 
  private:
   void emitLoadEvent();

diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index d7e586214f18d9330c21aafed7fc3ce41d0b5f8f..beb16a8a377d4f08f9032a1b2589b16a40f14b08 100644 (file)
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -148,6 +148,10 @@ m_marquee(0)
 
 RenderLayer::~RenderLayer()
 {
+    // If this layer is being autoscrolled, stop the autoscroll timer
+    if (m_object && m_object->document() && m_object->document()->frame() && m_object->document()->frame()->autoscrollRenderer() == m_object)
+        m_object->document()->frame()->stopAutoscrollTimer();
+
     destroyScrollbar(HorizontalScrollbar);
     destroyScrollbar(VerticalScrollbar);
 

diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index 6a0745161049adf352835c01e4cfce4bcb678e01..897409109a836dd1818d05601ce00399a865f513 100644 (file)
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -61,6 +61,10 @@ RenderListBox::RenderListBox(HTMLSelectElement* element)
 
 RenderListBox::~RenderListBox()
 {
+    // If this list box is being autoscrolled, stop the autoscroll timer
+    if (document() && document()->frame() && document()->frame()->autoscrollRenderer() == this)
+        document()->frame()->stopAutoscrollTimer();
+
     if (m_vBar && m_vBar->isWidget()) {
         element()->document()->view()->removeChild(static_cast<PlatformScrollbar*>(m_vBar));
         m_vBar->deref();