Changeset 136560 in webkit for trunk/Source/WebCore/css/CSSImageSetValue.cpp

Timestamp:

Dec 4, 2012, 1:50:18 PM (12 years ago)

Author:

[email protected]

Message:

Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
​https://bugs.webkit.org/show_bug.cgi?id=100621

Reviewed by Eric Seidel.

Source/WebCore:

r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
is cleared when CSSImageSetValue is going away.

Test: fast/css/image-set-value-not-removed-crash.html

• css/CSSImageSetValue.cpp:

(WebCore::CSSImageSetValue::~CSSImageSetValue):

• rendering/style/StyleCachedImageSet.h:

(WebCore::StyleCachedImageSet::clearImageSetValue):
(StyleCachedImageSet):

LayoutTests:

• fast/css/image-set-value-not-removed-crash-expected.txt: Added.
• fast/css/image-set-value-not-removed-crash.html: Added.

File:

• trunk/Source/WebCore/css/CSSImageSetValue.cpp (modified) (1 diff)

trunk/Source/WebCore/css/CSSImageSetValue.cpp

@@ -53 +53 @@
 CSSImageSetValue::~CSSImageSetValue()
 {
+    if (m_imageSet && m_imageSet->isCachedImageSet())
+        static_cast<StyleCachedImageSet*>(m_imageSet.get())->clearImageSetValue();
 }