Title: [125234] trunk
- Revision
- 125234
- Author
- [email protected]
- Date
- 2012-08-09 19:04:47 -0700 (Thu, 09 Aug 2012)
Log Message
Crash in WebCore::RenderTable::cellBefore
https://bugs.webkit.org/show_bug.cgi?id=91160
Reviewed by Abhishek Arya.
Source/WebCore:
The issue was that we wouldn't properly set the row index on row in a newly split table. When inserting
the cell into the new row, we would try to repaint the cell which would access the row index and crash.
This came from splitAnonymousBoxesAroundChild calling RenderObjectChildList::insertChildNode directly
which doesn't invoke the row setting logic (RenderTableSection::addChild for example but we cannot call
addChild due to concern over splitting flows in the general case).
Test: fast/table/split-anonymous-boxes-around-table-repaint-crash.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::splitAnonymousBoxesAroundChild):
Dirty our parent box, which forces a cell recomputation which will set the row index. This needs to
be done *before* we insert the child to avoid crashing when repainting the new child.
LayoutTests:
* fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt: Added.
* fast/table/split-anonymous-boxes-around-table-repaint-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125233 => 125234)
--- trunk/LayoutTests/ChangeLog 2012-08-10 01:54:04 UTC (rev 125233)
+++ trunk/LayoutTests/ChangeLog 2012-08-10 02:04:47 UTC (rev 125234)
@@ -1,3 +1,13 @@
+2012-08-09 Julien Chaffraix <[email protected]>
+
+ Crash in WebCore::RenderTable::cellBefore
+ https://bugs.webkit.org/show_bug.cgi?id=91160
+
+ Reviewed by Abhishek Arya.
+
+ * fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt: Added.
+ * fast/table/split-anonymous-boxes-around-table-repaint-crash.html: Added.
+
2012-08-09 Roger Fong <[email protected]>
LayoutTest: fast/forms/select/menulist-popup-crash.html timeout on Windows.
Added: trunk/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt (0 => 125234)
--- trunk/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash-expected.txt 2012-08-10 02:04:47 UTC (rev 125234)
@@ -0,0 +1,2 @@
+Bug 91160: Crash in WebCore::RenderTable::cellBefore
+PASS. WebKit didn't crash
Added: trunk/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash.html (0 => 125234)
--- trunk/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash.html (rev 0)
+++ trunk/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash.html 2012-08-10 02:04:47 UTC (rev 125234)
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<style>
+.table {
+ display: table;
+ border-collapse: collapse;
+}
+.tableCell {
+ display: table-cell;
+}
+.tableRowGroup {
+ border-style: solid solid solid none;
+ display: table-row-group;
+}
+</style>
+<body style="-webkit-writing-mode: vertical-rl;">
+<div class="table">
+ A
+ <span id="span1"></span>
+ <span class="tableCell"></span>
+<div>
+</div>
+<div class="tableRowGroup">B</div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+document.body.offsetTop;
+span1.style.display = "table-footer-group";
+
+document.body.offsetTop;
+document.body.innerHTML = "Bug <a href=''>91160</a>: Crash in WebCore::RenderTable::cellBefore<br>PASS. WebKit didn't crash";
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (125233 => 125234)
--- trunk/Source/WebCore/ChangeLog 2012-08-10 01:54:04 UTC (rev 125233)
+++ trunk/Source/WebCore/ChangeLog 2012-08-10 02:04:47 UTC (rev 125234)
@@ -1,3 +1,23 @@
+2012-08-09 Julien Chaffraix <[email protected]>
+
+ Crash in WebCore::RenderTable::cellBefore
+ https://bugs.webkit.org/show_bug.cgi?id=91160
+
+ Reviewed by Abhishek Arya.
+
+ The issue was that we wouldn't properly set the row index on row in a newly split table. When inserting
+ the cell into the new row, we would try to repaint the cell which would access the row index and crash.
+ This came from splitAnonymousBoxesAroundChild calling RenderObjectChildList::insertChildNode directly
+ which doesn't invoke the row setting logic (RenderTableSection::addChild for example but we cannot call
+ addChild due to concern over splitting flows in the general case).
+
+ Test: fast/table/split-anonymous-boxes-around-table-repaint-crash.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::splitAnonymousBoxesAroundChild):
+ Dirty our parent box, which forces a cell recomputation which will set the row index. This needs to
+ be done *before* we insert the child to avoid crashing when repainting the new child.
+
2012-08-09 Erik Arvidsson <[email protected]>
[V8] Fix issues with [DoNotCheckSecurity] which depended on non ES5 compliant behavior
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (125233 => 125234)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2012-08-10 01:54:04 UTC (rev 125233)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2012-08-10 02:04:47 UTC (rev 125234)
@@ -4006,6 +4006,10 @@
RenderBox* postBox = boxToSplit->createAnonymousBoxWithSameTypeAs(this);
postBox->setChildrenInline(boxToSplit->childrenInline());
RenderBox* parentBox = toRenderBox(boxToSplit->parent());
+ // We need to invalidate the |parentBox| before inserting the new node
+ // so that the table repainting logic knows the structure is dirty.
+ // See for example RenderTableCell:clippedOverflowRectForRepaint.
+ markBoxForRelayoutAfterSplit(parentBox);
parentBox->virtualChildren()->insertChildNode(parentBox, postBox, boxToSplit->nextSibling());
boxToSplit->moveChildrenTo(postBox, beforeChild, 0, true);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
