Title: [118816] trunk
- Revision
- 118816
- Author
- [email protected]
- Date
- 2012-05-29 12:15:26 -0700 (Tue, 29 May 2012)
Log Message
Crash due to text fragment destruction when updating first-letter block.
https://bugs.webkit.org/show_bug.cgi?id=87751
Reviewed by Eric Seidel.
Source/WebCore:
Test: fast/text/text-fragment-first-letter-update-crash.html
* rendering/RenderObject.cpp:
(WebCore::RenderObject::setStyle):
LayoutTests:
* fast/text/text-fragment-first-letter-update-crash-expected.txt: Added.
* fast/text/text-fragment-first-letter-update-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (118815 => 118816)
--- trunk/LayoutTests/ChangeLog 2012-05-29 19:12:34 UTC (rev 118815)
+++ trunk/LayoutTests/ChangeLog 2012-05-29 19:15:26 UTC (rev 118816)
@@ -1,3 +1,13 @@
+2012-05-29 Abhishek Arya <[email protected]>
+
+ Crash due to text fragment destruction when updating first-letter block.
+ https://bugs.webkit.org/show_bug.cgi?id=87751
+
+ Reviewed by Eric Seidel.
+
+ * fast/text/text-fragment-first-letter-update-crash-expected.txt: Added.
+ * fast/text/text-fragment-first-letter-update-crash.html: Added.
+
2012-05-29 Thiago Marcos P. Santos <[email protected]>
[EFL] Gardening of failing tests and new passes
Added: trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash-expected.txt (0 => 118816)
--- trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash-expected.txt 2012-05-29 19:15:26 UTC (rev 118816)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Added: trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash.html (0 => 118816)
--- trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash.html (rev 0)
+++ trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash.html 2012-05-29 19:15:26 UTC (rev 118816)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+#el0 { -webkit-columns: 1; }
+#el2:first-of-type { }
+#el2:first-letter { content: counter(c); }
+#el3 { -webkit-column-span: all; content: counter(c) attr(A); }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+el0 = document.createElement('div');
+el0.setAttribute('id', 'el0');
+document.body.appendChild(el0);
+el1=document.createElement('b');
+el0.appendChild(el1);
+el1.appendChild(document.createTextNode('A'));
+el2=document.createElement('div');
+el2.setAttribute('id','el2');
+el0.appendChild(el2);
+el3=document.createElement('div');
+el3.setAttribute('id', 'el3');
+el2.appendChild(el3);
+document.designMode = 'on';
+document.execCommand('selectall');
+el2.appendChild(document.createTextNode('AA'));
+document.designMode = 'on';
+document.execCommand('selectall');
+document.execCommand('removeFormat');
+document.body.offsetTop;
+document.body.innerHTML = "PASS. WebKit didn't crash.";
+
+</script>
+</body>
+</html>
\ No newline at end of file
Property changes on: trunk/LayoutTests/fast/text/text-fragment-first-letter-update-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (118815 => 118816)
--- trunk/Source/WebCore/ChangeLog 2012-05-29 19:12:34 UTC (rev 118815)
+++ trunk/Source/WebCore/ChangeLog 2012-05-29 19:15:26 UTC (rev 118816)
@@ -1,3 +1,15 @@
+2012-05-29 Abhishek Arya <[email protected]>
+
+ Crash due to text fragment destruction when updating first-letter block.
+ https://bugs.webkit.org/show_bug.cgi?id=87751
+
+ Reviewed by Eric Seidel.
+
+ Test: fast/text/text-fragment-first-letter-update-crash.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::setStyle):
+
2012-05-29 David Hyatt <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=87764
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (118815 => 118816)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2012-05-29 19:12:34 UTC (rev 118815)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2012-05-29 19:15:26 UTC (rev 118816)
@@ -1788,9 +1788,15 @@
if (m_style->outlineWidth() > 0 && m_style->outlineSize() > maximalOutlineSize(PaintPhaseOutline))
toRenderView(document()->renderer())->setMaximalOutlineSize(m_style->outlineSize());
+ bool doesNotNeedLayout = !m_parent || isText();
+
styleDidChange(diff, oldStyle.get());
- if (!m_parent || isText())
+ // FIXME: |this| might be destroyed here. This can currently happen for a RenderTextFragment when
+ // its first-letter block gets an update in RenderTextFragment::styleDidChange. For RenderTextFragment(s),
+ // we will safely bail out with the doesNotNeedLayout flag. We might want to broaden this condition
+ // in the future as we move renderer changes out of layout and into style changes.
+ if (doesNotNeedLayout)
return;
// Now that the layer (if any) has been updated, we need to adjust the diff again,
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
