Title: [109406] trunk/Source/WebCore
- Revision
- 109406
- Author
- [email protected]
- Date
- 2012-03-01 13:27:36 -0800 (Thu, 01 Mar 2012)
Log Message
Prevent layout root to remain set on renderers getting destroyed.
https://bugs.webkit.org/show_bug.cgi?id=79953
Reviewed by Eric Seidel.
Implement Julien Chaffraix's idea.
* page/FrameView.h:
(WebCore::FrameView::clearLayoutRoot): helper to clear layout root.
* rendering/RenderObject.cpp:
(WebCore::clearLayoutRootIfNeeded): if we know we are going
away and we are the view's layout root, then we need to reset the layout
root to prevent being used.
(WebCore):
(WebCore::RenderObject::willBeDestroyed): call clearLayoutRootIfNeeded at end.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (109405 => 109406)
--- trunk/Source/WebCore/ChangeLog 2012-03-01 21:26:50 UTC (rev 109405)
+++ trunk/Source/WebCore/ChangeLog 2012-03-01 21:27:36 UTC (rev 109406)
@@ -1,3 +1,21 @@
+2012-03-01 Abhishek Arya <[email protected]>
+
+ Prevent layout root to remain set on renderers getting destroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=79953
+
+ Reviewed by Eric Seidel.
+
+ Implement Julien Chaffraix's idea.
+
+ * page/FrameView.h:
+ (WebCore::FrameView::clearLayoutRoot): helper to clear layout root.
+ * rendering/RenderObject.cpp:
+ (WebCore::clearLayoutRootIfNeeded): if we know we are going
+ away and we are the view's layout root, then we need to reset the layout
+ root to prevent being used.
+ (WebCore):
+ (WebCore::RenderObject::willBeDestroyed): call clearLayoutRootIfNeeded at end.
+
2012-03-01 Kangil Han <[email protected]>
[DRT] Remove all PlainTextController usages in existing tests by adding internal API
Modified: trunk/Source/WebCore/page/FrameView.h (109405 => 109406)
--- trunk/Source/WebCore/page/FrameView.h 2012-03-01 21:26:50 UTC (rev 109405)
+++ trunk/Source/WebCore/page/FrameView.h 2012-03-01 21:27:36 UTC (rev 109406)
@@ -99,6 +99,7 @@
bool isInLayout() const { return m_inLayout; }
RenderObject* layoutRoot(bool _onlyDuringLayout_ = false) const;
+ void clearLayoutRoot() { m_layoutRoot = 0; }
int layoutCount() const { return m_layoutCount; }
bool needsLayout() const;
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (109405 => 109406)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2012-03-01 21:26:50 UTC (rev 109405)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2012-03-01 21:27:36 UTC (rev 109406)
@@ -2240,6 +2240,21 @@
return st == SelectionStart || st == SelectionEnd || st == SelectionBoth;
}
+inline void RenderObject::clearLayoutRootIfNeeded() const
+{
+ if (node() && !documentBeingDestroyed() && frame()) {
+ if (FrameView* view = frame()->view()) {
+ if (view->layoutRoot() == this) {
+ ASSERT_NOT_REACHED();
+ // This indicates a failure to layout the child, which is why
+ // the layout root is still set to |this|. Make sure to clear it
+ // since we are getting destroyed.
+ view->clearLayoutRoot();
+ }
+ }
+ }
+}
+
void RenderObject::willBeDestroyed()
{
// Destroy any leftover anonymous children.
@@ -2290,6 +2305,8 @@
setHasLayer(false);
toRenderBoxModelObject(this)->destroyLayer();
}
+
+ clearLayoutRootIfNeeded();
}
void RenderObject::destroyAndCleanupAnonymousWrappers()
Modified: trunk/Source/WebCore/rendering/RenderObject.h (109405 => 109406)
--- trunk/Source/WebCore/rendering/RenderObject.h 2012-03-01 21:26:50 UTC (rev 109405)
+++ trunk/Source/WebCore/rendering/RenderObject.h 2012-03-01 21:27:36 UTC (rev 109406)
@@ -870,6 +870,7 @@
void adjustRectForOutlineAndShadow(LayoutRect&) const;
+ void clearLayoutRootIfNeeded() const;
virtual void willBeDestroyed();
void arenaDelete(RenderArena*, void* objectBase);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
