Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged called during attachment
https://bugs.webkit.org/show_bug.cgi?id=85912
Reviewed by Eric Seidel.
Source/WebCore:
Tests: fast/images/link-body-content-imageDimensionChanged-crash.html
fast/images/script-counter-imageDimensionChanged-crash.html
The bug comes from CSS generated images that could end up calling imageDimensionsChanged during attachment. As the
rest of the code (e.g. computedCSSPadding*) would assumes that we are already inserted in the tree, we would crash.
The solution is to bail out in this case as newly inserted RenderObject will trigger layout later on and properly
handle what we would be doing as part of imageDimensionChanged (the only exception being updating our intrinsic
size which should be done as part of imageDimensionsChanged).
* rendering/RenderImage.cpp:
(WebCore::RenderImage::imageDimensionsChanged):
LayoutTests:
* fast/images/link-body-content-imageDimensionChanged-crash-expected.txt: Added.
* fast/images/link-body-content-imageDimensionChanged-crash.html: Added.
* fast/images/script-counter-imageDimensionChanged-crash-expected.txt: Added.
* fast/images/script-counter-imageDimensionChanged-crash.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
7 files changed
