[webkit-reviews] review denied: [Bug 34153] Crash in WebCore while processing the fast scrolling code path. : [Attachment 47403] Unregister the RenderObject in corner cases

[bugzilla-daemon at webkit.org]

Simon Fraser (smfr) <simon.fraser at apple.com> has denied Benjamin Poulain
<benjamin.poulain at nokia.com>'s request for review:
Bug 34153: Crash in WebCore while processing the fast scrolling code path.
https://bugs.webkit.org/show_bug.cgi?id=34153

Attachment 47403: Unregister the RenderObject in corner cases
https://bugs.webkit.org/attachment.cgi?id=47403&action=review

------- Additional Comments from Simon Fraser (smfr) <simon.fraser at apple.com>
> diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog

> +	   The code to unregister the object with fixed positionning must
> +	   be copied to RenderWidget.

"positionning"

> +	   Unregistering must also be done when a render widget get a 
> +	   transformation.

Not just a RenderWidget, but any RenderObject. "gets", not "get".

> diff --git a/WebCore/rendering/RenderWidget.cpp
b/WebCore/rendering/RenderWidget.cpp

>      animation()->cancelAnimations(this);
>  
> -    if (RenderView* v = view())
> +    if (RenderView* v = view()) {
>	   v->removeWidget(this);
> +	   FrameView* frameView = view()->frameView();
> +	   if (frameView)
> +	       frameView->unregisterFixedPositionedObject(this);
> +    }

Why doesn't this have the "m_style->position() == FixedPosition" check that
RenderObject does? Is one of them wrong?

This also needs a layout test. r- for that.