commit 53a3dcd7c72148a8967b6e7ff824f6cc9a63b511
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Sep 16 18:06:48 2010 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Sep 16 18:06:48 2010 +0000
tree 46c8b4a3f74529af1d8db6424fbc85a76160f6c9
parent ddd6642137228bf787611785e1333983cea6d9b6

2010-09-16  Daniel Cheng  <dcheng@chromium.org>

        Reviewed by Tony Chang.

        Fix incorrect usage of dissolveDragImageToFraction().
        https://bugs.webkit.org/show_bug.cgi?id=45835

        createDragImageForSelection() was ignoring the return value of
        dissolveDragImageToFraction(). This didn't happen to crash on most
        platforms, since most implementations simply modified the image that was
        passed in. However, Chromium Mac's implementation actually creates a new
        image and returns that instead. This caused us to crash when copying the
        image from the renderer to the browser process, since the memory had
        already been freed.

        * manual-tests/selection-drag-crash.html: Added.
        * platform/DragImage.cpp:
        (WebCore::createDragImageForSelection):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@67641 268f45cc-cd09-0410-ab3c-d52691b4dbfc