Title: [113597] trunk
- Revision
- 113597
- Author
- [email protected]
- Date
- 2012-04-09 11:21:05 -0700 (Mon, 09 Apr 2012)
Log Message
Crash due to floats not cleared before starting SVG <text> layout.
https://bugs.webkit.org/show_bug.cgi?id=83021
Reviewed by Dirk Schulze.
.:
* ManualTests/svg-text-float-not-removed-crash.html: Added.
Source/WebCore:
Manual Test - ManualTests/svg-text-float-not-removed-crash.html.
Can't reproduce the failure in DRT.
forceLayoutInlineChildren is used in SVG <text> layout and overrides
RenderBlock::layoutBlock. However, it missed the 'clearFloats' step,
which will cause a crash when trying to access removed renderers.
* rendering/RenderBlock.h:
(WebCore::RenderBlock::forceLayoutInlineChildren):
Modified Paths
Added Paths
Diff
Modified: trunk/ChangeLog (113596 => 113597)
--- trunk/ChangeLog 2012-04-09 18:19:00 UTC (rev 113596)
+++ trunk/ChangeLog 2012-04-09 18:21:05 UTC (rev 113597)
@@ -1,3 +1,12 @@
+2012-04-09 Abhishek Arya <[email protected]>
+
+ Crash due to floats not cleared before starting SVG <text> layout.
+ https://bugs.webkit.org/show_bug.cgi?id=83021
+
+ Reviewed by Dirk Schulze.
+
+ * ManualTests/svg-text-float-not-removed-crash.html: Added.
+
2012-04-09 Patrick Gansterer <[email protected]>
[CMake] Build fix for USE_SYSTEM_MALLOC after r113570.
Added: trunk/ManualTests/svg-text-float-not-removed-crash.html (0 => 113597)
--- trunk/ManualTests/svg-text-float-not-removed-crash.html (rev 0)
+++ trunk/ManualTests/svg-text-float-not-removed-crash.html 2012-04-09 18:21:05 UTC (rev 113597)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<script>
+setInterval(function(){
+ var elements = document.getElementsByTagName("*");
+ var didRemoveElement = false;
+ for (var i = 0; i < elements.length; i++) {
+ var element = elements.item(i);
+ if (!element.firstElementChild && element != document.documentElement) {
+ didRemoveElement = true;
+ try {
+ element.parentNode.removeChild(element)
+ } catch(e) { }
+ }
+ }
+
+ if (!didRemoveElement)
+ document.documentElement.innerHTML = "PASS. WebKit didn't crash.";
+}, 100);
+</script>
+<style>
+#test1:after {
+ float: left;
+ content: 'A';
+}
+</style>
+<svg>
+<text>
+<a id="test1">
+A
+</a>
+</text>
+</svg>
+</html>
Property changes on: trunk/ManualTests/svg-text-float-not-removed-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (113596 => 113597)
--- trunk/Source/WebCore/ChangeLog 2012-04-09 18:19:00 UTC (rev 113596)
+++ trunk/Source/WebCore/ChangeLog 2012-04-09 18:21:05 UTC (rev 113597)
@@ -1,3 +1,20 @@
+2012-04-09 Abhishek Arya <[email protected]>
+
+ Crash due to floats not cleared before starting SVG <text> layout.
+ https://bugs.webkit.org/show_bug.cgi?id=83021
+
+ Reviewed by Dirk Schulze.
+
+ Manual Test - ManualTests/svg-text-float-not-removed-crash.html.
+ Can't reproduce the failure in DRT.
+
+ forceLayoutInlineChildren is used in SVG <text> layout and overrides
+ RenderBlock::layoutBlock. However, it missed the 'clearFloats' step,
+ which will cause a crash when trying to access removed renderers.
+
+ * rendering/RenderBlock.h:
+ (WebCore::RenderBlock::forceLayoutInlineChildren):
+
2012-04-09 Jeffrey Pfau <[email protected]>
Filter files from dataTransfer.getData on Mac
Modified: trunk/Source/WebCore/rendering/RenderBlock.h (113596 => 113597)
--- trunk/Source/WebCore/rendering/RenderBlock.h 2012-04-09 18:19:00 UTC (rev 113596)
+++ trunk/Source/WebCore/rendering/RenderBlock.h 2012-04-09 18:21:05 UTC (rev 113597)
@@ -458,6 +458,7 @@
{
LayoutUnit repaintLogicalTop = 0;
LayoutUnit repaintLogicalBottom = 0;
+ clearFloats(NormalLayoutPass);
layoutInlineChildren(true, repaintLogicalTop, repaintLogicalBottom);
}
#endif
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
