[Webkit-unassigned] [Bug 66531] Don't detach elements from the render tree when entering fullscreen mode

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=66531





--- Comment #14 from Jer Noble <jer.noble at apple.com>  2011-08-23 10:06:48 PST ---
(From update of attachment 104784)
View in context: https://bugs.webkit.org/attachment.cgi?id=104784&action=review

> Source/WebCore/rendering/RenderFullScreen.cpp:101
> -    fullscreenStyle->setLeft(Length(0, Fixed));
> -    fullscreenStyle->setTop(Length(0, Fixed));
> +    fullscreenStyle->setLeft(Length(0, WebCore::Fixed));
> +    fullscreenStyle->setTop(Length(0, WebCore::Fixed));

I'm curious why this is necessary, given the "using namespace WebCore;" directive above.

> Source/WebCore/rendering/RenderFullScreen.cpp:133
> +    if (wrappedRenderer)
> +        wrappedRenderer->remove();
> +    RenderObject* holder = placeholder() ? placeholder() : this;
> +    RenderObject* parent = holder->parent();
> +    if (parent)
> +        parent->addChild(wrappedRenderer, holder);

You null-check wrappedRenderer before calling remove(), but not before passing wrappedRenderer to parent->addChild().  It appears it's not safe to pass a null value into that function (see RenderObject.cpp), so the second if statement should check wrappedRenderer as well.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.