Title: [95423] branches/chromium/874
- Revision
- 95423
- Author
- infe...@chromium.org
- Date
- 2011-09-19 09:42:09 -0700 (Mon, 19 Sep 2011)
Log Message
Merge 95074
BUG=96444
Review URL: http://codereview.chromium.org/7945004
Modified Paths
Added Paths
Diff
Copied: branches/chromium/874/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt (from rev 95074, trunk/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt) (0 => 95423)
--- branches/chromium/874/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt (rev 0)
+++ branches/chromium/874/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash-expected.txt 2011-09-19 16:42:09 UTC (rev 95423)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+PASS
Copied: branches/chromium/874/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html (from rev 95074, trunk/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html) (0 => 95423)
--- branches/chromium/874/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html (rev 0)
+++ branches/chromium/874/LayoutTests/scrollbars/scrollbar-part-created-with-no-parent-crash.html 2011-09-19 16:42:09 UTC (rev 95423)
@@ -0,0 +1,53 @@
+<html>
+Test passes if it does not crash.
+<style>
+body
+{
+ margin: 0;
+}
+::-webkit-scrollbar {
+ -webkit-logical-height: 65536;
+ -webkit-border-image: url(does_not_exist) 0 2 0 2;
+}
+
+.inner:not(table) {
+ padding: 400px;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function showScroller()
+{
+ var scroller = document.createElement('div');
+ scroller.className = 'scroller';
+
+ var contents = document.createElement('div')
+ contents.className = 'inner';
+ scroller.appendChild(contents);
+
+ document.getElementById('container').appendChild(scroller);
+}
+
+function hideScroller()
+{
+ var scroller = document.getElementById('container').querySelectorAll('.scroller')[0];
+ scroller.parentNode.removeChild(scroller);
+}
+
+function doTest()
+{
+ if (window.eventSender) {
+ eventSender.mouseMoveTo(50, 40);
+ eventSender.mouseMoveTo(50, 55);
+ eventSender.mouseMoveTo(50, 0);
+ }
+}
+
+window.addEventListener('load', doTest, false);
+</script>
+<div id="container" _onmouseover_="showScroller()" _onmouseout_="hideScroller()">
+<p>PASS</p>
+</div>
+</html>
\ No newline at end of file
Modified: branches/chromium/874/Source/WebCore/rendering/RenderScrollbar.cpp (95422 => 95423)
--- branches/chromium/874/Source/WebCore/rendering/RenderScrollbar.cpp 2011-09-19 16:40:53 UTC (rev 95422)
+++ branches/chromium/874/Source/WebCore/rendering/RenderScrollbar.cpp 2011-09-19 16:42:09 UTC (rev 95423)
@@ -64,7 +64,15 @@
RenderScrollbar::~RenderScrollbar()
{
- ASSERT(m_parts.isEmpty());
+ if (!m_parts.isEmpty()) {
+ // When a scrollbar is detached from its parent (causing all parts removal) and
+ // ready to be destroyed, its destruction can be delayed because of RefPtr
+ // maintained in other classes such as EventHandler (m_lastScrollbarUnderMouse).
+ // Meanwhile, we can have a call to updateScrollbarPart which recreates the
+ // scrollbar part. So, we need to destroy these parts since we don't want them
+ // to call on a destroyed scrollbar. See webkit bug 68009.
+ updateScrollbarParts(true);
+ }
}
RenderBox* RenderScrollbar::owningRenderer() const
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
