Title: [94001] trunk
- Revision
- 94001
- Author
- [email protected]
- Date
- 2011-08-29 12:19:52 -0700 (Mon, 29 Aug 2011)
Log Message
Crash in InlineBox::deleteLine due to accessing removed
renderer.
https://bugs.webkit.org/show_bug.cgi?id=66015
Reviewed by Simon Fraser.
Source/WebCore:
Test: fast/block/line-layout/inline-box-wrapper-crash.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::positionLineBox): Make sure that the
previous inline box wrapper is destroyed properly, before
setting a new one.
LayoutTests:
* fast/block/line-layout/inline-box-wrapper-crash-expected.txt: Added.
* fast/block/line-layout/inline-box-wrapper-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (94000 => 94001)
--- trunk/LayoutTests/ChangeLog 2011-08-29 19:19:02 UTC (rev 94000)
+++ trunk/LayoutTests/ChangeLog 2011-08-29 19:19:52 UTC (rev 94001)
@@ -1,3 +1,14 @@
+2011-08-29 Abhishek Arya <[email protected]>
+
+ Crash in InlineBox::deleteLine due to accessing removed
+ renderer.
+ https://bugs.webkit.org/show_bug.cgi?id=66015
+
+ Reviewed by Simon Fraser.
+
+ * fast/block/line-layout/inline-box-wrapper-crash-expected.txt: Added.
+ * fast/block/line-layout/inline-box-wrapper-crash.html: Added.
+
2011-08-29 Chris Marrin <[email protected]>
Fixing LayoutTests broken by http://trac.webkit.org/changeset/93980
Added: trunk/LayoutTests/fast/block/line-layout/inline-box-wrapper-crash-expected.txt (0 => 94001)
--- trunk/LayoutTests/fast/block/line-layout/inline-box-wrapper-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/line-layout/inline-box-wrapper-crash-expected.txt 2011-08-29 19:19:52 UTC (rev 94001)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/fast/block/line-layout/inline-box-wrapper-crash.html (0 => 94001)
--- trunk/LayoutTests/fast/block/line-layout/inline-box-wrapper-crash.html (rev 0)
+++ trunk/LayoutTests/fast/block/line-layout/inline-box-wrapper-crash.html 2011-08-29 19:19:52 UTC (rev 94001)
@@ -0,0 +1,24 @@
+<html>
+<style>
+ body { direction: rtl; padding-left: 100%; }
+</style>
+<script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ function runTest() {
+ document.body.innerHTML = "PASS";
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+
+ setTimeout("runTest()", 0);
+</script>
+0<image>
+<span>
+A<div></div>
+</span>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (94000 => 94001)
--- trunk/Source/WebCore/ChangeLog 2011-08-29 19:19:02 UTC (rev 94000)
+++ trunk/Source/WebCore/ChangeLog 2011-08-29 19:19:52 UTC (rev 94001)
@@ -1,3 +1,18 @@
+2011-08-29 Abhishek Arya <[email protected]>
+
+ Crash in InlineBox::deleteLine due to accessing removed
+ renderer.
+ https://bugs.webkit.org/show_bug.cgi?id=66015
+
+ Reviewed by Simon Fraser.
+
+ Test: fast/block/line-layout/inline-box-wrapper-crash.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::positionLineBox): Make sure that the
+ previous inline box wrapper is destroyed properly, before
+ setting a new one.
+
2011-08-29 Alexey Proskuryakov <[email protected]>
Lion build fix.
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (94000 => 94001)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2011-08-29 19:19:02 UTC (rev 94000)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2011-08-29 19:19:52 UTC (rev 94001)
@@ -1377,6 +1377,8 @@
box->destroy(renderArena());
} else if (isReplaced()) {
setLocation(roundedLayoutPoint(FloatPoint(box->x(), box->y())));
+ if (m_inlineBoxWrapper)
+ deleteLineBoxWrapper();
m_inlineBoxWrapper = box;
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
