Diff
Modified: branches/chromium/1364/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt (143493 => 143494)
--- branches/chromium/1364/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt 2013-02-20 21:27:56 UTC (rev 143494)
@@ -1,3 +1,3 @@
Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
Test passes if it does not crash.
-
+
Deleted: branches/chromium/1364/LayoutTests/fast/css-generated-content/quote-layout-focus-crash-expected.txt (143493 => 143494)
--- branches/chromium/1364/LayoutTests/fast/css-generated-content/quote-layout-focus-crash-expected.txt 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/LayoutTests/fast/css-generated-content/quote-layout-focus-crash-expected.txt 2013-02-20 21:27:56 UTC (rev 143494)
@@ -1,3 +0,0 @@
-Bug 109616 - ASSERT(!renderer()->needsLayout()) when calling Element::focus() with generated content
-
-
Deleted: branches/chromium/1364/LayoutTests/fast/css-generated-content/quote-layout-focus-crash.html (143493 => 143494)
--- branches/chromium/1364/LayoutTests/fast/css-generated-content/quote-layout-focus-crash.html 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/LayoutTests/fast/css-generated-content/quote-layout-focus-crash.html 2013-02-20 21:27:56 UTC (rev 143494)
@@ -1,47 +0,0 @@
-<!DOCTYPE html>
-
-<style>
- /* Must be positioned absolute or static, must have margins to push it out view. */
- .positioned {
- position: absolute;
- margin-top: 100%;
- }
-
- /* Any kind of quote will do, can be either :before or :after */
- .positioned:before,
- .focusable:before {
- content: open-quote;
- }
-</style>
-
-<p>Bug 109616 - ASSERT(!renderer()->needsLayout()) when calling Element::focus() with generated content</p>
-
-<!--
- This is testing a case where RenderQuote::updateDepth will mark the RenderQuote
- and its ancestors as needing layout in the middle of a layout of its ancestor.
- When its ancestor finishes the layout it will mark itself and the ancestors
- farther up as no longer needing layout. The end result is some subtree
- needing layout, but the RenderView and possibly other ancestors of the subtree
- not needing layout.
-
- ex.
-
- RenderView <- !needsLayout
- \
- RenderBlock (.focusable) <- needsLayout
- \
- RenderBlock (generated content) <- needsLayout
- \
- RenderQuote <- needsLayout
--->
-
-<div class="positioned"></div>
-<div class="focusable" tabindex="1"></div>
-
-<script>
- if (window.testRunner)
- testRunner.dumpAsText();
- // .focusable still needs layout at this point, but RenderView doesn't
- // think any descendants need layout.
- document.querySelector('.focusable').focus();
-</script>
Modified: branches/chromium/1364/Source/WebCore/dom/Document.cpp (143493 => 143494)
--- branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-02-20 21:27:56 UTC (rev 143494)
@@ -1927,9 +1927,6 @@
StackStats::LayoutCheckPoint layoutCheckPoint;
- if (renderView())
- renderView()->markQuoteContainingBlocksForLayoutIfNeeded();
-
// Only do a layout if changes have occurred that make it necessary.
if (frameView && renderer() && (frameView->layoutPending() || renderer()->needsLayout()))
frameView->layout();
@@ -2480,10 +2477,7 @@
m_overMinimumLayoutThreshold = true;
if (!ownerElement() || (ownerElement()->renderer() && !ownerElement()->renderer()->needsLayout())) {
updateStyleIfNeeded();
-
- if (renderView())
- renderView()->markQuoteContainingBlocksForLayoutIfNeeded();
-
+
// Always do a layout after loading if needed.
if (view() && renderObject && (!renderObject->firstChild() || renderObject->needsLayout()))
view()->layout();
Modified: branches/chromium/1364/Source/WebCore/rendering/RenderQuote.h (143493 => 143494)
--- branches/chromium/1364/Source/WebCore/rendering/RenderQuote.h 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/Source/WebCore/rendering/RenderQuote.h 2013-02-20 21:27:56 UTC (rev 143494)
@@ -38,8 +38,6 @@
void attachQuote();
void detachQuote();
- RenderQuote* next() { return m_next; }
-
private:
virtual void willBeDestroyed() OVERRIDE;
virtual const char* renderName() const OVERRIDE { return "RenderQuote"; };
Modified: branches/chromium/1364/Source/WebCore/rendering/RenderView.cpp (143493 => 143494)
--- branches/chromium/1364/Source/WebCore/rendering/RenderView.cpp 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/Source/WebCore/rendering/RenderView.cpp 2013-02-20 21:27:56 UTC (rev 143494)
@@ -36,7 +36,6 @@
#include "RenderLayer.h"
#include "RenderLayerBacking.h"
#include "RenderNamedFlowThread.h"
-#include "RenderQuote.h"
#include "RenderSelectionInfo.h"
#include "RenderWidget.h"
#include "RenderWidgetProtector.h"
@@ -1038,18 +1037,6 @@
return m_intervalArena.get();
}
-void RenderView::markQuoteContainingBlocksForLayoutIfNeeded()
-{
- for (RenderQuote* quote = m_renderQuoteHead; quote; quote = quote->next()) {
- if (!quote->needsLayout())
- continue;
- // Can't use markContainingBlocksForLayout because it would abort as soon
- // as it sees a parent that already thinks it needs layout.
- for (RenderObject* renderer = quote->parent(); renderer; renderer = renderer->parent())
- renderer->setChildNeedsLayout(true, MarkOnlyThis);
- }
-}
-
void RenderView::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
{
MemoryClassInfo info(memoryObjectInfo, this, PlatformMemoryTypes::Rendering);
Modified: branches/chromium/1364/Source/WebCore/rendering/RenderView.h (143493 => 143494)
--- branches/chromium/1364/Source/WebCore/rendering/RenderView.h 2013-02-20 21:24:14 UTC (rev 143493)
+++ branches/chromium/1364/Source/WebCore/rendering/RenderView.h 2013-02-20 21:27:56 UTC (rev 143494)
@@ -229,11 +229,6 @@
void removeRenderCounter() { ASSERT(m_renderCounterCount > 0); m_renderCounterCount--; }
bool hasRenderCounters() { return m_renderCounterCount; }
- // FIXME: This is a hack until we have proper pre layout tasks to handle quote attachment.
- // See RenderQuote::updateDepth for more details about what this is a workaround for.
- // See: https://bugs.webkit.org/show_bug.cgi?id=109628
- void markQuoteContainingBlocksForLayoutIfNeeded();
-
protected:
virtual void mapLocalToContainer(const RenderLayerModelObject* repaintContainer, TransformState&, MapCoordinatesFlags = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
virtual const RenderObject* pushMappingToContainer(const RenderLayerModelObject* ancestorToStopAt, RenderGeometryMap&) const OVERRIDE;
