Diff
Modified: trunk/LayoutTests/ChangeLog (100066 => 100067)
--- trunk/LayoutTests/ChangeLog 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/ChangeLog 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,3 +1,16 @@
+2011-11-11 Ojan Vafai <[email protected]>
+
+ Unreviewed. Rollout http://trac.webkit.org/changeset/99744.
+ https://bugs.webkit.org/show_bug.cgi?id=72203
+ r99744 causes crash in Chromium's dom_perf test.
+
+ * fast/table/crash-splitColumn-2-expected.txt: Removed.
+ * fast/table/crash-splitColumn-2.html: Removed.
+ * fast/table/crash-splitColumn-3-expected.txt: Removed.
+ * fast/table/crash-splitColumn-3.html: Removed.
+ * fast/table/crash-splitColumn-expected.txt: Removed.
+ * fast/table/crash-splitColumn.html: Removed.
+
2011-11-11 Dominic Mazzoni <[email protected]>
Add test to ensure that an anonymous render block in a continuation doesn't crash.
Deleted: trunk/LayoutTests/fast/table/crash-splitColumn-2-expected.txt (100066 => 100067)
--- trunk/LayoutTests/fast/table/crash-splitColumn-2-expected.txt 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/fast/table/crash-splitColumn-2-expected.txt 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,6 +0,0 @@
-Bug 70171: Crash in RenderTableSection::splitColumn
-
-This test PASSES if it does not CRASH or ASSERT.
-
-
-
Deleted: trunk/LayoutTests/fast/table/crash-splitColumn-2.html (100066 => 100067)
--- trunk/LayoutTests/fast/table/crash-splitColumn-2.html 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/fast/table/crash-splitColumn-2.html 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,64 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.c7 { display: table-row-group; }
-.c7:nth-last-of-type(-n+6) { float: none; }
-.c21:nth-child(2n) { position: static; float: left; }
-.c26 { border-style: ridge; content: counter(section);</style>
-<script>
-if (window.layoutTestController) {
- layoutTestController.dumpAsText();
- layoutTestController.waitUntilDone();
-}
-
-function crash()
-{
- var img = document.createElement('img');
- img.appendChild(select);
- if (window.layoutTestController)
- layoutTestController.notifyDone();
-}
-
-function insertNodes() {
- document.documentElement.appendChild(document.createElement('a'));
- document.documentElement.appendChild(document.createElement('dfn'));
- document.documentElement.appendChild(document.createElement('keygen'));
- var iframe = document.createElement('iframe');
- iframe.setAttribute('src', 'dne.html');
- document.documentElement.appendChild(iframe);
- document.documentElement.appendChild(document.createElement('rp'));
- document.documentElement.appendChild(document.createElement('ul'));
- document.documentElement.appendChild(document.createElement('option'));
- document.documentElement.appendChild(document.createElement('label'));
- document.documentElement.appendChild(document.createElement('table'));
- document.documentElement.appendChild(document.createElement('mark'));
- document.documentElement.appendChild(document.createElement('bdo'));
- document.documentElement.appendChild(document.createElement('colgroup'));
- document.documentElement.appendChild(document.createElement('strong'));
-
- select = document.createElement('select');
- document.documentElement.appendChild(select);
-
- var sup = document.createElement('sup');
- sup.setAttribute('class', 'c7');
- document.documentElement.appendChild(sup);
- var td = document.createElement('td');
- td.setAttribute('class', 'c21');
- document.documentElement.appendChild(td);
-
- var th = document.createElement('th');
- th.setAttribute('colspan', '2');
- th.setAttribute('class', 'c26');
- sup.appendChild(th);
-
- setTimeout(crash, 0);
-}
-window.addEventListener("load", insertNodes, false);
-</script>
-</head>
-<body>
-<p> Bug <a href="" Crash in RenderTableSection::splitColumn</p>
-<p> This test PASSES if it does not CRASH or ASSERT.</p>
-</body>
-</html>
Deleted: trunk/LayoutTests/fast/table/crash-splitColumn-3-expected.txt (100066 => 100067)
--- trunk/LayoutTests/fast/table/crash-splitColumn-3-expected.txt 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/fast/table/crash-splitColumn-3-expected.txt 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,5 +0,0 @@
-Bug 70171: Crash in RenderTableSection::splitColumn
-
-This test PASSES if it does not CRASH or ASSERT.
-
-
Deleted: trunk/LayoutTests/fast/table/crash-splitColumn-3.html (100066 => 100067)
--- trunk/LayoutTests/fast/table/crash-splitColumn-3.html 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/fast/table/crash-splitColumn-3.html 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-if (window.layoutTestController)
- layoutTestController.dumpAsText();
-
-function crash()
-{
- var firstCell = document.getElementById("firstCell");
- firstCell.parentNode.removeChild(firstCell);
-}
-
-window.addEventListener("load", crash, false);
-</script>
-</head>
-<body>
-<p> Bug <a href="" Crash in RenderTableSection::splitColumn</p>
-<p> This test PASSES if it does not CRASH or ASSERT.</p>
-<table><tr><td id="firstCell">foobar</td><td colspan="2"></td><td></td></tr></table>
-</body>
-</html>
Deleted: trunk/LayoutTests/fast/table/crash-splitColumn-expected.txt (100066 => 100067)
--- trunk/LayoutTests/fast/table/crash-splitColumn-expected.txt 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/fast/table/crash-splitColumn-expected.txt 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,5 +0,0 @@
-Bug 70171: Crash in RenderTableSection::splitColumn
-
-This test PASSES if it does not CRASH or ASSERT.
-
-
Deleted: trunk/LayoutTests/fast/table/crash-splitColumn.html (100066 => 100067)
--- trunk/LayoutTests/fast/table/crash-splitColumn.html 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/LayoutTests/fast/table/crash-splitColumn.html 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,38 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<style>
-.lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
-</style>
-<script>
-if (window.layoutTestController) {
- layoutTestController.dumpAsText();
- layoutTestController.waitUntilDone();
-}
-
-function crash()
-{
- rubyTag.appendChild(lastTableHead);
- if (window.layoutTestController)
- layoutTestController.notifyDone();
-}
-
-function insertNodes() {
- var tableHead = document.createElement('th');
- tableHead.setAttribute('colspan', '5');
- tableHead.setAttribute('class', 'lastTableHeaderGroup');
- document.documentElement.appendChild(tableHead);
- tableHead.appendChild(document.createElement('p'));
- lastTableHead = document.createElement('th');
- document.documentElement.appendChild(lastTableHead);
- rubyTag = document.createElement('rt');
- setTimeout(crash, 0);
-}
-window.addEventListener("load", insertNodes, false);
-</script>
-</head>
-<body>
-<p> Bug <a href="" Crash in RenderTableSection::splitColumn</p>
-<p> This test PASSES if it does not CRASH or ASSERT.</p>
-</body>
-</html>
Modified: trunk/Source/WebCore/ChangeLog (100066 => 100067)
--- trunk/Source/WebCore/ChangeLog 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/Source/WebCore/ChangeLog 2011-11-12 04:40:28 UTC (rev 100067)
@@ -1,3 +1,17 @@
+2011-11-11 Ojan Vafai <[email protected]>
+
+ Unreviewed. Rollout http://trac.webkit.org/changeset/99744.
+ https://bugs.webkit.org/show_bug.cgi?id=72203
+ r99744 causes crash in Chromium's dom_perf test.
+
+ * rendering/RenderTable.cpp:
+ (WebCore::RenderTable::splitColumn):
+ (WebCore::RenderTable::appendColumn):
+ * rendering/RenderTableSection.cpp:
+ (WebCore::RenderTableSection::addCell):
+ (WebCore::RenderTableSection::recalcCells):
+ (WebCore::RenderTableSection::appendColumn):
+
2011-11-11 James Robinson <[email protected]>
[chromium] Removed unused local from CCThreadProxy::scheduledActionCommit
Modified: trunk/Source/WebCore/rendering/RenderTable.cpp (100066 => 100067)
--- trunk/Source/WebCore/rendering/RenderTable.cpp 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/Source/WebCore/rendering/RenderTable.cpp 2011-11-12 04:40:28 UTC (rev 100067)
@@ -645,17 +645,10 @@
memmove(m_columns.data() + position + 1, m_columns.data() + position, (oldSize - position) * sizeof(ColumnStruct));
m_columns[position + 1].span = oldSpan - firstSpan;
- // Propagate the change in our columns representation to the sections that don't need
- // cell recalc. If they do, they will be synced up directly with m_columns later.
+ // change width of all rows.
for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
- if (!child->isTableSection())
- continue;
-
- RenderTableSection* section = toRenderTableSection(child);
- if (section->needsCellRecalc())
- continue;
-
- section->splitColumn(position, firstSpan);
+ if (child->isTableSection())
+ toRenderTableSection(child)->splitColumn(position, firstSpan);
}
m_columnPos.grow(numEffCols() + 1);
@@ -664,22 +657,16 @@
void RenderTable::appendColumn(int span)
{
- unsigned pos = m_columns.size();
- unsigned newSize = pos + 1;
+ // easy case.
+ int pos = m_columns.size();
+ int newSize = pos + 1;
m_columns.grow(newSize);
m_columns[pos].span = span;
- // Propagate the change in our columns representation to the sections that don't need
- // cell recalc. If they do, they will be synced up directly with m_columns later.
+ // change width of all rows.
for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
- if (!child->isTableSection())
- continue;
-
- RenderTableSection* section = toRenderTableSection(child);
- if (section->needsCellRecalc())
- continue;
-
- section->appendColumn(pos);
+ if (child->isTableSection())
+ toRenderTableSection(child)->appendColumn(pos);
}
m_columnPos.grow(numEffCols() + 1);
Modified: trunk/Source/WebCore/rendering/RenderTableSection.cpp (100066 => 100067)
--- trunk/Source/WebCore/rendering/RenderTableSection.cpp 2011-11-12 04:28:19 UTC (rev 100066)
+++ trunk/Source/WebCore/rendering/RenderTableSection.cpp 2011-11-12 04:40:28 UTC (rev 100067)
@@ -187,12 +187,6 @@
void RenderTableSection::addCell(RenderTableCell* cell, RenderTableRow* row)
{
- // We don't insert the cell if we need cell recalc as our internal columns' representation
- // will have drifted from the table's representation. Also recalcCells will call addCell
- // at a later time after sync'ing our columns' with the table's.
- if (needsCellRecalc())
- return;
-
int rSpan = cell->rowSpan();
int cSpan = cell->colSpan();
Vector<RenderTable::ColumnStruct>& columns = table()->columns();
@@ -1122,11 +1116,6 @@
void RenderTableSection::recalcCells()
{
- ASSERT(m_needsCellRecalc);
- // We reset the flag here to ensure that |addCell| works. This is safe to do as
- // we clear the grid and properly rebuild it during |addCell|.
- m_needsCellRecalc = false;
-
m_cCol = 0;
m_cRow = 0;
m_grid.clear();
@@ -1153,6 +1142,7 @@
}
m_grid.shrinkToFit();
+ m_needsCellRecalc = false;
setNeedsLayout(true);
}
@@ -1185,8 +1175,6 @@
void RenderTableSection::appendColumn(int pos)
{
- ASSERT(!m_needsCellRecalc);
-
for (unsigned row = 0; row < m_grid.size(); ++row)
m_grid[row].row.resize(pos + 1);
}
