2011-01-16 Simon Fraser <simon.fraser@apple.com>

smfr · smfr · commit 2e4f58cf930b · 2011-01-17T03:49:59.000Z
Reviewed by Dan Bernstein. frame-removed-during-resize.html test crashes (shows up as image-map-2.html crash) https://bugs.webkit.org/show_bug.cgi?id=52549 Fix regression from r75900; m_widget->setFrameRect() can run script that clears m_widget, so null-check it before calling setBoundsSize(). Tested by fast/replaced/frame-removed-during-resize.html * rendering/RenderWidget.cpp: (WebCore::RenderWidget::setWidgetGeometry): Canonical link: https://commits.webkit.org/66152@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@75906 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2011-01-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        frame-removed-during-resize.html test crashes (shows up as image-map-2.html crash)
+        https://bugs.webkit.org/show_bug.cgi?id=52549
+
+        Fix regression from r75900; m_widget->setFrameRect() can run script that
+        clears m_widget, so null-check it before calling setBoundsSize().
+        
+        Tested by fast/replaced/frame-removed-during-resize.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+
 2011-01-16  Simon Fraser  <simon.fraser@apple.com>
 
         Keep Leopard build happy.
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
@@ -174,7 +174,8 @@ bool RenderWidget::setWidgetGeometry(const IntRect& frame, const IntSize& bounds
     RenderWidgetProtector protector(this);
     RefPtr<Node> protectedNode(node());
     m_widget->setFrameRect(frame);
-    m_widget->setBoundsSize(boundsSize);
+    if (m_widget) // setFrameRect can run arbitrary script, which might clear m_widget.
+        m_widget->setBoundsSize(boundsSize);
     
 #if USE(ACCELERATED_COMPOSITING)
     if (hasLayer() && layer()->isComposited())
