commit 886b7c51015dd539242e1a8137bbcd38e0b30885
author alokp@chromium.org <alokp@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Feb 28 19:15:16 2012 +0000
committer alokp@chromium.org <alokp@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Feb 28 19:15:16 2012 +0000
tree b2ac641aba4f23ce6180422b3fa72f18767a3832
parent 97f6819f86cf17f19db3294872d112bac8d90f14

Heap-use-after-free in WebCore::RenderLayer::addChild
https://bugs.webkit.org/show_bug.cgi?id=79698

Reviewed by Simon Fraser.

Source/WebCore:

This patch fixes a regression introduced in r108659.
The reflection layer was moved to the parent by mistake. It was then
deleted and the parent was left holding on to a deleted pointer. This
patch restores the location where reflection layer is removed - before
moving the child layers.

Test: fast/reflections/toggle-reflection-crash.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::removeOnlyThisLayer):

LayoutTests:

* fast/reflections/toggle-reflection-crash-expected.txt: Added.
* fast/reflections/toggle-reflection-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@109125 268f45cc-cd09-0410-ab3c-d52691b4dbfc