commit fac7d85cb8429f3dee77f0cc4de1dc3993ed1c83
author jchaffraix@webkit.org <jchaffraix@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Dec 04 21:10:03 2012 +0000
committer jchaffraix@webkit.org <jchaffraix@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Dec 04 21:10:03 2012 +0000
tree 74e204bd031ca78bf1d295c5d8bc6e7606f58a93
parent c8aa3d8f2b844530c42b1cf410d52fba955d4071

Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]
https://bugs.webkit.org/show_bug.cgi?id=100764

Reviewed by Eric Seidel.

Source/WebCore:

Test: mathml/mfenced-root-layer.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::stackingContext):
Fixed this function to ensure that it always returns a stacking context, the bug
was that the document element's layer wasn't guaranteed to be a stacking context.

LayoutTests:

* mathml/mfenced-root-layer-expected.txt: Added.
* mathml/mfenced-root-layer.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136554 268f45cc-cd09-0410-ab3c-d52691b4dbfc