Title: [118248] trunk
- Revision
- 118248
- Author
- [email protected]
- Date
- 2012-05-23 14:47:51 -0700 (Wed, 23 May 2012)
Log Message
Crash in RenderInline::linesVisualOverflowBoundingBox.
https://bugs.webkit.org/show_bug.cgi?id=85804
Reviewed by Dave Hyatt.
Source/WebCore:
Defer layout of replaced elements to the next line break function.
We shouldn't do it while we are clearing our inline chilren
lineboxes in full layout mode.
Test: fast/block/inline-children-root-linebox-crash.html
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::layoutInlineChildren):
(WebCore::RenderBlock::LineBreaker::nextLineBreak):
LayoutTests:
* fast/block/inline-children-root-linebox-crash-expected.txt: Added.
* fast/block/inline-children-root-linebox-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (118247 => 118248)
--- trunk/LayoutTests/ChangeLog 2012-05-23 21:46:15 UTC (rev 118247)
+++ trunk/LayoutTests/ChangeLog 2012-05-23 21:47:51 UTC (rev 118248)
@@ -1,3 +1,13 @@
+2012-05-23 Abhishek Arya <[email protected]>
+
+ Crash in RenderInline::linesVisualOverflowBoundingBox.
+ https://bugs.webkit.org/show_bug.cgi?id=85804
+
+ Reviewed by Dave Hyatt.
+
+ * fast/block/inline-children-root-linebox-crash-expected.txt: Added.
+ * fast/block/inline-children-root-linebox-crash.html: Added.
+
2012-05-23 Chris Rogers <[email protected]>
AudioParam must support fan-in (multiple audio connections)
Added: trunk/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt (0 => 118248)
--- trunk/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt 2012-05-23 21:47:51 UTC (rev 118248)
@@ -0,0 +1,3 @@
+WebKit Bug 85804 - Crash in RenderInline::linesVisualOverflowBoundingBox.
+Test passes if it does not crash.
+
Added: trunk/LayoutTests/fast/block/inline-children-root-linebox-crash.html (0 => 118248)
--- trunk/LayoutTests/fast/block/inline-children-root-linebox-crash.html (rev 0)
+++ trunk/LayoutTests/fast/block/inline-children-root-linebox-crash.html 2012-05-23 21:47:51 UTC (rev 118248)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+WebKit Bug 85804 - Crash in RenderInline::linesVisualOverflowBoundingBox.<br />
+Test passes if it does not crash.
+<div style='-webkit-writing-mode: vertical-rl;'>
+<div style='-webkit-transform: translatey(1px) translatez(1px) rotatex(1deg);'></div>
+<textarea></textarea>
+<span style='-webkit-opacity: 0.0;'/>
+<input autofocus>
+</div>
+<body dir=rtl>
+</body>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</html>
Property changes on: trunk/LayoutTests/fast/block/inline-children-root-linebox-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (118247 => 118248)
--- trunk/Source/WebCore/ChangeLog 2012-05-23 21:46:15 UTC (rev 118247)
+++ trunk/Source/WebCore/ChangeLog 2012-05-23 21:47:51 UTC (rev 118248)
@@ -1,3 +1,20 @@
+2012-05-23 Abhishek Arya <[email protected]>
+
+ Crash in RenderInline::linesVisualOverflowBoundingBox.
+ https://bugs.webkit.org/show_bug.cgi?id=85804
+
+ Reviewed by Dave Hyatt.
+
+ Defer layout of replaced elements to the next line break function.
+ We shouldn't do it while we are clearing our inline chilren
+ lineboxes in full layout mode.
+
+ Test: fast/block/inline-children-root-linebox-crash.html
+
+ * rendering/RenderBlockLineLayout.cpp:
+ (WebCore::RenderBlock::layoutInlineChildren):
+ (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
2012-05-23 Chris Rogers <[email protected]>
AudioParam must support fan-in (multiple audio connections) (take 2)
Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (118247 => 118248)
--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-05-23 21:46:15 UTC (rev 118247)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-05-23 21:47:51 UTC (rev 118248)
@@ -1503,7 +1503,6 @@
else if (layoutState.isFullLayout() || o->needsLayout()) {
// Replaced elements
toRenderBox(o)->dirtyLineBoxes(layoutState.isFullLayout());
- o->layoutIfNeeded();
}
} else if (o->isText() || (o->isRenderInline() && !walker.atEndOfInline())) {
if (!o->isText())
@@ -2273,6 +2272,7 @@
width.addUncommittedWidth(borderPaddingMarginStart(flowBox) + borderPaddingMarginEnd(flowBox));
} else if (current.m_obj->isReplaced()) {
RenderBox* replacedBox = toRenderBox(current.m_obj);
+ replacedBox->layoutIfNeeded();
// Break on replaced elements if either has normal white-space.
if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!current.m_obj->isImage() || allowImagesToBreak)) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
