Diff
Copied: branches/chromium/1025/LayoutTests/fast/regions/flexbox-in-region-crash-expected.txt (from rev 106694, trunk/LayoutTests/fast/regions/flexbox-in-region-crash-expected.txt) (0 => 107303)
--- branches/chromium/1025/LayoutTests/fast/regions/flexbox-in-region-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/regions/flexbox-in-region-crash-expected.txt 2012-02-10 00:21:31 UTC (rev 107303)
@@ -0,0 +1,6 @@
+Bug 77474: Crash in RenderFlowThread::setRegionBoxesRegionStyle
+
+This test PASSES if it does not CRASH or ASSERT.
+
+
+
Copied: branches/chromium/1025/LayoutTests/fast/regions/flexbox-in-region-crash.html (from rev 106694, trunk/LayoutTests/fast/regions/flexbox-in-region-crash.html) (0 => 107303)
--- branches/chromium/1025/LayoutTests/fast/regions/flexbox-in-region-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/regions/flexbox-in-region-crash.html 2012-02-10 00:21:31 UTC (rev 107303)
@@ -0,0 +1,51 @@
+<!doctype html>
+<html>
+ <head>
+ <style>
+ #el1 {
+ -webkit-flow-into: A;
+ display: -webkit-flexbox;
+ }
+ #el3 {
+ -webkit-flow-from: A;
+ }
+ </style>
+ <script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ _onload_ = function() {
+ el1 = document.createElement('div')
+ el1.setAttribute('id','el1')
+ document.body.appendChild(el1)
+
+ el2 = document.createElement('div')
+ document.body.appendChild(el2)
+
+ el3 = document.createElement('hr')
+ el3.setAttribute('id','el3')
+ el2.appendChild(el3)
+
+ el4 = document.createElement('p')
+ el4.setAttribute('id', 'el4')
+ el5 = document.createTextNode("P1")
+ el4.appendChild(el5)
+ el1.appendChild(el4)
+
+ setTimeout(function() {
+ el1.style.display='inline'
+ el4.style.visibility = 'hidden'
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ },0)
+ }
+ </script>
+ </head>
+ <body>
+ <p> Bug <a href="" Crash in RenderFlowThread::setRegionBoxesRegionStyle</p>
+ <p> This test PASSES if it does not CRASH or ASSERT.</p>
+ </body>
+</html>
Copied: branches/chromium/1025/LayoutTests/fast/regions/select-in-region-crash-expected.txt (from rev 106694, trunk/LayoutTests/fast/regions/select-in-region-crash-expected.txt) (0 => 107303)
--- branches/chromium/1025/LayoutTests/fast/regions/select-in-region-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/regions/select-in-region-crash-expected.txt 2012-02-10 00:21:31 UTC (rev 107303)
@@ -0,0 +1,5 @@
+Bug 77474: Crash in RenderFlowThread::setRegionBoxesRegionStyle
+
+This test PASSES if it does not CRASH or ASSERT.
+
+
Copied: branches/chromium/1025/LayoutTests/fast/regions/select-in-region-crash.html (from rev 106694, trunk/LayoutTests/fast/regions/select-in-region-crash.html) (0 => 107303)
--- branches/chromium/1025/LayoutTests/fast/regions/select-in-region-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/regions/select-in-region-crash.html 2012-02-10 00:21:31 UTC (rev 107303)
@@ -0,0 +1,44 @@
+<!doctype html>
+<html>
+ <head>
+ <style>
+ #el1 { -webkit-flow-into: A; }
+ #el3 { -webkit-flow-from: A; }
+ </style>
+ <script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ _onload_ = function() {
+ el1=document.createElement('div')
+ el1.setAttribute('id','el1')
+ document.body.appendChild(el1)
+
+ el2=document.createElement('div')
+ document.body.appendChild(el2)
+
+ el3=document.createElement('hr')
+ el3.setAttribute('id','el3')
+ el2.appendChild(el3)
+
+ el4=document.createElement('select')
+ el1.appendChild(el4)
+ el4.style.display='block'
+
+ setTimeout(function() {
+ el4.style.display='inline'
+ el4.style.visibility = 'hidden'
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ },0)
+ }
+ </script>
+ </head>
+ <body>
+ <p> Bug <a href="" Crash in RenderFlowThread::setRegionBoxesRegionStyle</p>
+ <p> This test PASSES if it does not CRASH or ASSERT.</p>
+ </body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-02-10 00:21:31 UTC (rev 107303)
@@ -1207,6 +1207,27 @@
clearLayoutOverflow();
}
+void RenderBlock::computeInitialRegionRangeForBlock()
+{
+ if (inRenderFlowThread()) {
+ // Set our start and end regions. No regions above or below us will be considered by our children. They are
+ // effectively clamped to our region range.
+ LayoutUnit oldHeight = logicalHeight();
+ LayoutUnit oldLogicalTop = logicalTop();
+ setLogicalHeight(numeric_limits<LayoutUnit>::max() / 2);
+ computeLogicalHeight();
+ enclosingRenderFlowThread()->setRegionRangeForBox(this, offsetFromLogicalTopOfFirstPage());
+ setLogicalHeight(oldHeight);
+ setLogicalTop(oldLogicalTop);
+ }
+}
+
+void RenderBlock::computeRegionRangeForBlock()
+{
+ if (inRenderFlowThread())
+ enclosingRenderFlowThread()->setRegionRangeForBox(this, offsetFromLogicalTopOfFirstPage());
+}
+
void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight, BlockLayoutPass layoutPass)
{
ASSERT(needsLayout());
@@ -1266,22 +1287,13 @@
RenderView* renderView = view();
RenderStyle* styleToUse = style();
LayoutStateMaintainer statePusher(renderView, this, locationOffset(), hasColumns() || hasTransform() || hasReflection() || styleToUse->isFlippedBlocksWritingMode(), pageLogicalHeight, pageLogicalHeightChanged, colInfo);
-
+
if (inRenderFlowThread()) {
// Regions changing widths can force us to relayout our children.
if (logicalWidthChangedInRegions())
relayoutChildren = true;
-
- // Set our start and end regions. No regions above or below us will be considered by our children. They are
- // effectively clamped to our region range.
- LayoutUnit oldHeight = logicalHeight();
- LayoutUnit oldLogicalTop = logicalTop();
- setLogicalHeight(numeric_limits<LayoutUnit>::max() / 2);
- computeLogicalHeight();
- enclosingRenderFlowThread()->setRegionRangeForBox(this, offsetFromLogicalTopOfFirstPage());
- setLogicalHeight(oldHeight);
- setLogicalTop(oldLogicalTop);
}
+ computeInitialRegionRangeForBlock();
// We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
// our current maximal positive and negative margins. These values are used when we
@@ -1359,8 +1371,7 @@
bool needAnotherLayoutPass = layoutPositionedObjects(relayoutChildren || isRoot());
- if (inRenderFlowThread())
- enclosingRenderFlowThread()->setRegionRangeForBox(this, offsetFromLogicalTopOfFirstPage());
+ computeRegionRangeForBlock();
// Add overflow from children (unless we're multi-column, since in that case all our child overflow is clipped anyway).
computeOverflow(oldClientAfterEdge);
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.h (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.h 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.h 2012-02-10 00:21:31 UTC (rev 107303)
@@ -448,6 +448,8 @@
}
#endif
+ void computeInitialRegionRangeForBlock();
+ void computeRegionRangeForBlock();
private:
virtual RenderObjectChildList* virtualChildren() { return children(); }
virtual const RenderObjectChildList* virtualChildren() const { return children(); }
@@ -468,6 +470,7 @@
void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
void addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild);
void addChildToAnonymousColumnBlocks(RenderObject* newChild, RenderObject* beforeChild);
+
virtual void addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild, RenderObject* beforeChild = 0);
virtual bool isSelfCollapsingBlock() const;
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp 2012-02-10 00:21:31 UTC (rev 107303)
@@ -228,6 +228,13 @@
LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
LayoutStateMaintainer statePusher(view(), this, LayoutSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+ if (inRenderFlowThread()) {
+ // Regions changing widths can force us to relayout our children.
+ if (logicalWidthChangedInRegions())
+ relayoutChildren = true;
+ }
+ computeInitialRegionRangeForBlock();
+
LayoutSize previousSize = size();
computeLogicalWidth();
@@ -267,6 +274,8 @@
bool needAnotherLayoutPass = layoutPositionedObjects(relayoutChildren || isRoot());
+ computeRegionRangeForBlock();
+
if (!isFloatingOrPositioned() && height() == 0) {
// We are a block with no border and padding and a computed height
// of 0. The CSS spec states that zero-height blocks collapse their margins
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderFlexibleBox.cpp (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderFlexibleBox.cpp 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderFlexibleBox.cpp 2012-02-10 00:21:31 UTC (rev 107303)
@@ -166,6 +166,13 @@
LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+ if (inRenderFlowThread()) {
+ // Regions changing widths can force us to relayout our children.
+ if (logicalWidthChangedInRegions())
+ relayoutChildren = true;
+ }
+ computeInitialRegionRangeForBlock();
+
IntSize previousSize = size();
setLogicalHeight(0);
@@ -193,6 +200,8 @@
layoutPositionedObjects(relayoutChildren || isRoot());
+ computeRegionRangeForBlock();
+
// FIXME: css3/flexbox/repaint-rtl-column.html seems to repaint more overflow than it needs to.
computeOverflow(oldClientAfterEdge);
statePusher.pop();
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderFlowThread.cpp (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderFlowThread.cpp 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderFlowThread.cpp 2012-02-10 00:21:31 UTC (rev 107303)
@@ -204,6 +204,7 @@
void RenderFlowThread::removeRegionFromThread(RenderRegion* renderRegion)
{
ASSERT(renderRegion);
+
m_regionRangeMap.clear();
m_regionList.remove(renderRegion);
@@ -628,7 +629,7 @@
RenderRegion* startRegion;
RenderRegion* endRegion;
getRegionRangeForBox(box, startRegion, endRegion);
-
+
for (RenderRegionList::iterator iter = m_regionList.find(startRegion); iter != m_regionList.end(); ++iter) {
RenderRegion* region = *iter;
if (!region->isValid())
@@ -637,7 +638,17 @@
if (region == endRegion)
break;
}
-
+
+#ifndef NDEBUG
+ // We have to make sure we did not left any boxes with region info attached in regions.
+ for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
+ RenderRegion* region = *iter;
+ if (!region->isValid())
+ continue;
+ ASSERT(!region->renderBoxRegionInfo(box));
+ }
+#endif
+
m_regionRangeMap.remove(box);
}
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderRegion.cpp (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderRegion.cpp 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderRegion.cpp 2012-02-10 00:21:31 UTC (rev 107303)
@@ -13,7 +13,7 @@
* disclaimer in the documentation and/or other materials
* provided with the distribution.
*
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
@@ -47,9 +47,6 @@
, m_parentFlowThread(0)
, m_isValid(false)
, m_hasCustomRegionStyle(false)
-#ifndef NDEBUG
- , m_insideRegionPaint(false)
-#endif
{
}
@@ -134,17 +131,9 @@
if (!m_flowThread || !isValid())
return;
-#ifndef NDEBUG
- m_insideRegionPaint = true;
-#endif
-
setRegionBoxesRegionStyle();
m_flowThread->paintIntoRegion(paintInfo, this, LayoutPoint(paintOffset.x() + borderLeft() + paddingLeft(), paintOffset.y() + borderTop() + paddingTop()));
restoreRegionBoxesOriginalStyle();
-
-#ifndef NDEBUG
- m_insideRegionPaint = false;
-#endif
}
// Hit Testing
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderRegion.h (107302 => 107303)
--- branches/chromium/1025/Source/WebCore/rendering/RenderRegion.h 2012-02-10 00:09:31 UTC (rev 107302)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderRegion.h 2012-02-10 00:21:31 UTC (rev 107303)
@@ -109,10 +109,6 @@
bool m_isValid;
bool m_hasCustomRegionStyle;
-
-#ifndef NDEBUG
- bool m_insideRegionPaint;
-#endif
};
inline RenderRegion* toRenderRegion(RenderObject* object)
