Title: [120737] trunk
- Revision
- 120737
- Author
- [email protected]
- Date
- 2012-06-19 11:05:58 -0700 (Tue, 19 Jun 2012)
Log Message
Crash in RenderInline::willBeDestroyed.
https://bugs.webkit.org/show_bug.cgi?id=89386
Reviewed by Julien Chaffraix.
Source/WebCore:
We were unable to find the previous continuation during the process
of cleaning up empty anonymous block continuation. The reason being
that we were just looking till our immediate parent and ignoring the
fact that it can be enclosed in anonymous blocks. The change skips
over anonymous blocks in the parent chain.
Test: fullscreen/empty-anonymous-block-continuation-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeChild):
LayoutTests:
* fullscreen/empty-anonymous-block-continuation-crash-expected.txt: Added.
* fullscreen/empty-anonymous-block-continuation-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (120736 => 120737)
--- trunk/LayoutTests/ChangeLog 2012-06-19 18:03:22 UTC (rev 120736)
+++ trunk/LayoutTests/ChangeLog 2012-06-19 18:05:58 UTC (rev 120737)
@@ -1,3 +1,13 @@
+2012-06-19 Abhishek Arya <[email protected]>
+
+ Crash in RenderInline::willBeDestroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=89386
+
+ Reviewed by Julien Chaffraix.
+
+ * fullscreen/empty-anonymous-block-continuation-crash-expected.txt: Added.
+ * fullscreen/empty-anonymous-block-continuation-crash.html: Added.
+
2012-06-19 Dirk Pranke <[email protected]>
new-run-webkit-tests reports unexpected pass of pixel tests when pixel testing is disabled
Added: trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash-expected.txt (0 => 120737)
--- trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash-expected.txt 2012-06-19 18:05:58 UTC (rev 120737)
@@ -0,0 +1,3 @@
+WebKit Bug 89386 - Crash in RenderInline::willBeDestroyed.
+Test passes if it does not crash.
+
Added: trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash.html (0 => 120737)
--- trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash.html (rev 0)
+++ trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash.html 2012-06-19 18:05:58 UTC (rev 120737)
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<body>
+WebKit Bug 89386 - Crash in RenderInline::willBeDestroyed.<br />
+Test passes if it does not crash.
+<summary>
+<i>
+<span id="test">
+<div></div>
+</span>
+</i>
+</summary>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+if ("webkitRequestFullScreen" in Element.prototype) {
+ var span = document.getElementById('test');
+ var fullscreenChangeEvent = function(event) {
+ if (document.webkitIsFullScreen)
+ document.webkitCancelFullScreen();
+ };
+
+ document.addEventListener('webkitfullscreenchange', fullscreenChangeEvent);
+ document.addEventListener('keydown', function () {
+ span.webkitRequestFullScreen();
+ });
+
+ eventSender.keyDown('a');
+}
+</script>
+</body>
+</html>
Property changes on: trunk/LayoutTests/fullscreen/empty-anonymous-block-continuation-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (120736 => 120737)
--- trunk/Source/WebCore/ChangeLog 2012-06-19 18:03:22 UTC (rev 120736)
+++ trunk/Source/WebCore/ChangeLog 2012-06-19 18:05:58 UTC (rev 120737)
@@ -1,3 +1,21 @@
+2012-06-19 Abhishek Arya <[email protected]>
+
+ Crash in RenderInline::willBeDestroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=89386
+
+ Reviewed by Julien Chaffraix.
+
+ We were unable to find the previous continuation during the process
+ of cleaning up empty anonymous block continuation. The reason being
+ that we were just looking till our immediate parent and ignoring the
+ fact that it can be enclosed in anonymous blocks. The change skips
+ over anonymous blocks in the parent chain.
+
+ Test: fullscreen/empty-anonymous-block-continuation-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::removeChild):
+
2012-06-19 Andreas Kling <[email protected]>
Remove the -webkit-match-nearest-mail-blockquote-color property.
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (120736 => 120737)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-06-19 18:03:22 UTC (rev 120736)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-06-19 18:05:58 UTC (rev 120737)
@@ -1237,7 +1237,10 @@
// If we are an empty anonymous block in the continuation chain,
// we need to remove ourself and fix the continuation chain.
if (!beingDestroyed() && isAnonymousBlockContinuation()) {
- for (RenderObject* curr = this; curr; curr = curr->previousInPreOrder(parent())) {
+ RenderObject* containingBlockIgnoringAnonymous = containingBlock();
+ while (containingBlockIgnoringAnonymous && containingBlockIgnoringAnonymous->isAnonymousBlock())
+ containingBlockIgnoringAnonymous = containingBlockIgnoringAnonymous->containingBlock();
+ for (RenderObject* curr = this; curr; curr = curr->previousInPreOrder(containingBlockIgnoringAnonymous)) {
if (curr->virtualContinuation() != this)
continue;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
