Title: [108659] trunk/Source/WebCore
- Revision
- 108659
- Author
- [email protected]
- Date
- 2012-02-23 12:46:31 -0800 (Thu, 23 Feb 2012)
Log Message
Microsoft IE fishtank demo causes assertion in RenderLayer::convertToLayerCoords
https://bugs.webkit.org/show_bug.cgi?id=61964
Reviewed by James Robinson.
The assertion is caused with the following callstack:
WebCore::RenderLayer::convertToLayerCoords
WebCore::RenderLayerCompositor::layerWillBeRemoved
WebCore::RenderLayer::removeChild
WebCore::RenderLayer::removeOnlyThisLayer
WebCore::RenderLayer::removeOnlyThisLayer removes itself from the parent
before moving its children to its parent. When WebCore::RenderLayer::convertToLayerCoords
is called for one of the children, it tries to walk to root only to stop at the immediate
parent which was disconnected from the tree in WebCore::RenderLayer::removeOnlyThisLayer.
If removal of layer is delayed until the children has been moved, the ASSERT is avoided.
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::removeOnlyThisLayer):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (108658 => 108659)
--- trunk/Source/WebCore/ChangeLog 2012-02-23 20:27:31 UTC (rev 108658)
+++ trunk/Source/WebCore/ChangeLog 2012-02-23 20:46:31 UTC (rev 108659)
@@ -1,3 +1,25 @@
+2012-02-23 Alok Priyadarshi <[email protected]>
+
+ Microsoft IE fishtank demo causes assertion in RenderLayer::convertToLayerCoords
+ https://bugs.webkit.org/show_bug.cgi?id=61964
+
+ Reviewed by James Robinson.
+
+ The assertion is caused with the following callstack:
+ WebCore::RenderLayer::convertToLayerCoords
+ WebCore::RenderLayerCompositor::layerWillBeRemoved
+ WebCore::RenderLayer::removeChild
+ WebCore::RenderLayer::removeOnlyThisLayer
+
+ WebCore::RenderLayer::removeOnlyThisLayer removes itself from the parent
+ before moving its children to its parent. When WebCore::RenderLayer::convertToLayerCoords
+ is called for one of the children, it tries to walk to root only to stop at the immediate
+ parent which was disconnected from the tree in WebCore::RenderLayer::removeOnlyThisLayer.
+ If removal of layer is delayed until the children has been moved, the ASSERT is avoided.
+
+ * rendering/RenderLayer.cpp:
+ (WebCore::RenderLayer::removeOnlyThisLayer):
+
2012-02-23 Matthew Delaney <[email protected]>
Fix for canvas breakage caused by r108597 from the following:
Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (108658 => 108659)
--- trunk/Source/WebCore/rendering/RenderLayer.cpp 2012-02-23 20:27:31 UTC (rev 108658)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp 2012-02-23 20:46:31 UTC (rev 108659)
@@ -1193,22 +1193,16 @@
// Dirty the clip rects.
clearClipRectsIncludingDescendants();
- // Remove us from the parent.
- RenderLayer* parent = m_parent;
RenderLayer* nextSib = nextSibling();
bool hasLayerOffset;
const LayoutPoint offsetFromRootBeforeMove = computeOffsetFromRoot(hasLayerOffset);
- parent->removeChild(this);
-
- if (reflection())
- removeChild(reflectionLayer());
// Now walk our kids and reattach them to our parent.
RenderLayer* current = m_first;
while (current) {
RenderLayer* next = current->nextSibling();
removeChild(current);
- parent->addChild(current, nextSib);
+ m_parent->addChild(current, nextSib);
current->setRepaintStatus(NeedsFullRepaint);
LayoutPoint offsetFromRoot = offsetFromRootBeforeMove;
// updateLayerPositions depends on hasLayer() already being false for proper layout.
@@ -1217,6 +1211,11 @@
current = next;
}
+ // Remove us from the parent.
+ if (reflection())
+ removeChild(reflectionLayer());
+ m_parent->removeChild(this);
+
m_renderer->destroyLayer();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
