Title: [98763] trunk
- Revision
- 98763
- Author
- [email protected]
- Date
- 2011-10-28 14:28:39 -0700 (Fri, 28 Oct 2011)
Log Message
Crash when splitting inline flows with generated floats
https://bugs.webkit.org/show_bug.cgi?id=70458
Patch by Ken Buchanan <[email protected]> on 2011-10-28
Reviewed by David Hyatt.
Source/WebCore:
When lineBoxes on a RenderBlock are being deleted, we now check the floating object list to
ensure references to them are being cleared.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::deleteLineBoxTree): Remove references to lineBox when deleting them
LayoutTests:
Added test for crash condition when splitting inline flows on an object with generated floats.
* fast/css-generated-content/inline-splitting-with-after-float-crash.html: Added
* fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt: Added
Modified Paths
Added Paths
Property Changed
Diff
Modified: trunk/LayoutTests/ChangeLog (98762 => 98763)
--- trunk/LayoutTests/ChangeLog 2011-10-28 21:26:57 UTC (rev 98762)
+++ trunk/LayoutTests/ChangeLog 2011-10-28 21:28:39 UTC (rev 98763)
@@ -1,3 +1,15 @@
+2011-10-28 Ken Buchanan <[email protected]>
+
+ Crash when splitting inline flows with generated floats
+ https://bugs.webkit.org/show_bug.cgi?id=70458
+
+ Reviewed by David Hyatt.
+
+ Added test for crash condition when splitting inline flows on an object with generated floats.
+
+ * fast/css-generated-content/inline-splitting-with-after-float-crash.html: Added
+ * fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt: Added
+
2011-10-28 John Gregg <[email protected]>
Unreviewed gardening.
Added: trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt (0 => 98763)
--- trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt 2011-10-28 21:28:39 UTC (rev 98763)
@@ -0,0 +1,2 @@
+PASS, if the script does not cause a crash or ASSERT failure
+
Property changes on: trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt
___________________________________________________________________
Added: svn:executable
Added: trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html (0 => 98763)
--- trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html 2011-10-28 21:28:39 UTC (rev 98763)
@@ -0,0 +1,27 @@
+<style>
+ .c2:after { float: left; content: "A"; }
+</style>
+PASS, if the script does not cause a crash or ASSERT failure
+<script>
+ function endTest(childSpan) {
+ childSpan.appendChild(divToInsert);
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+ function startTest() {
+ quoteNode = document.createElement('q');
+ document.documentElement.appendChild(quoteNode);
+ divToInsert = document.createElement('div');
+ parentSpan = document.createElement('span');
+ parentSpan.setAttribute('class', 'c2');
+ childSpan = document.createElement('span');
+ parentSpan.appendChild(childSpan);
+ document.documentElement.appendChild(parentSpan);
+ setTimeout('endTest(childSpan);', 50);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+ }
+ window._onload_ = startTest;
+</script>
Property changes on: trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (98762 => 98763)
--- trunk/Source/WebCore/ChangeLog 2011-10-28 21:26:57 UTC (rev 98762)
+++ trunk/Source/WebCore/ChangeLog 2011-10-28 21:28:39 UTC (rev 98763)
@@ -1,3 +1,16 @@
+2011-10-28 Ken Buchanan <[email protected]>
+
+ Crash when splitting inline flows with generated floats
+ https://bugs.webkit.org/show_bug.cgi?id=70458
+
+ Reviewed by David Hyatt.
+
+ When lineBoxes on a RenderBlock are being deleted, we now check the floating object list to
+ ensure references to them are being cleared.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::deleteLineBoxTree): Remove references to lineBox when deleting them
+
2011-10-28 Simon Fraser <[email protected]>
Remove Leopard-only code from GraphicsLayerCA
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (98762 => 98763)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2011-10-28 21:26:57 UTC (rev 98762)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2011-10-28 21:28:39 UTC (rev 98763)
@@ -838,6 +838,15 @@
void RenderBlock::deleteLineBoxTree()
{
+ if (containsFloats()) {
+ // Clear references to originating lines, since the lines are being deleted
+ const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+ FloatingObjectSetIterator end = floatingObjectSet.end();
+ for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+ ASSERT(!((*it)->m_originatingLine) || (*it)->m_originatingLine->renderer() == this);
+ (*it)->m_originatingLine = 0;
+ }
+ }
m_lineBoxes.deleteLineBoxTree(renderArena());
}
Property changes on: trunk/Source/WebCore/rendering/RenderBlock.cpp
___________________________________________________________________
Added: svn:executable
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
