[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 14:26:59 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit bbbea4d70c76497956548fdc3ee29cb96090a088
Author: aestes at apple.com <aestes at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Oct 8 21:57:29 2010 +0000

    2010-10-08  Andy Estes  <aestes at apple.com>
    
            Reviewed by Darin Adler.
    
            REGRESSION (r66599): Crash when using CSS content and -webkit-mask-box-image properties containing cached images.
            https://bugs.webkit.org/show_bug.cgi?id=47430
    
            Test: fast/replaced/css-content-and-webkit-mask-box-image-crash.html
    
            * rendering/RenderImage.cpp:
            (WebCore::RenderImage::imageChanged): imageChanged() can be called prior
            to m_imageResource being set. The appropriate thing to do in this case
            is to return early.
            (WebCore::RenderImage::notifyFinished): Ditto.
    2010-10-08  Andy Estes  <aestes at apple.com>
    
            Reviewed by Darin Adler.
    
            REGRESSION (r66599): Crash when using CSS content and -webkit-mask-box-image properties containing cached images.
            https://bugs.webkit.org/show_bug.cgi?id=47430
    
            * fast/replaced/css-content-and-webkit-mask-box-image-crash-expected.txt: Added.
            * fast/replaced/css-content-and-webkit-mask-box-image-crash.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@69423 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index c3ce498..ab384c4 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-08  Andy Estes  <aestes at apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r66599): Crash when using CSS content and -webkit-mask-box-image properties containing cached images.
+        https://bugs.webkit.org/show_bug.cgi?id=47430
+
+        * fast/replaced/css-content-and-webkit-mask-box-image-crash-expected.txt: Added.
+        * fast/replaced/css-content-and-webkit-mask-box-image-crash.html: Added.
+
 2010-10-08  Michael Saboff  <msaboff at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/replaced/css-content-and-webkit-mask-box-image-crash-expected.txt b/LayoutTests/fast/replaced/css-content-and-webkit-mask-box-image-crash-expected.txt
new file mode 100644
index 0000000..f4c5ace
--- /dev/null
+++ b/LayoutTests/fast/replaced/css-content-and-webkit-mask-box-image-crash-expected.txt
@@ -0,0 +1,2 @@
+The test passes if you see the Safari icon below.
+
diff --git a/LayoutTests/fast/replaced/css-content-and-webkit-mask-box-image-crash.html b/LayoutTests/fast/replaced/css-content-and-webkit-mask-box-image-crash.html
new file mode 100644
index 0000000..4f12718
--- /dev/null
+++ b/LayoutTests/fast/replaced/css-content-and-webkit-mask-box-image-crash.html
@@ -0,0 +1,15 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function insertSpan() {
+        document.getElementById("container").innerHTML = "<span style=\"content:url('resources/compass.jpg'); -webkit-mask-box-image:url('resources/compass.jpg');\">FAIL</span>";
+    }
+</script>
+<body onload="insertSpan()">
+    The test passes if you see the Safari icon below.
+    <div id="container"></div>
+    <script>
+        insertSpan();
+    </script>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index b626b36..01e92f1 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2010-10-08  Andy Estes  <aestes at apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r66599): Crash when using CSS content and -webkit-mask-box-image properties containing cached images.
+        https://bugs.webkit.org/show_bug.cgi?id=47430
+
+        Test: fast/replaced/css-content-and-webkit-mask-box-image-crash.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged): imageChanged() can be called prior
+        to m_imageResource being set. The appropriate thing to do in this case
+        is to return early.
+        (WebCore::RenderImage::notifyFinished): Ditto.
+
 2010-10-08  Andrei Popescu  <andreip at google.com>
 
         Reviewed by Jeremy Orlow.
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index 2ed20c4..f889926 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -127,6 +127,9 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 
     if (hasBoxDecorations() || hasMask())
         RenderReplaced::imageChanged(newImage, rect);
+    
+    if (!m_imageResource)
+        return;
 
     if (newImage != m_imageResource->imagePtr() || !newImage)
         return;
@@ -191,6 +194,9 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 
 void RenderImage::notifyFinished(CachedResource* newImage)
 {
+    if (!m_imageResource)
+        return;
+    
     if (documentBeingDestroyed())
         return;
 

-- 
WebKit Debian packaging

