Title: [125315] trunk/Source/WebCore
- Revision
- 125315
- Author
- [email protected]
- Date
- 2012-08-10 12:41:20 -0700 (Fri, 10 Aug 2012)
Log Message
Crash on accessing a removed layout root in FrameView::scheduleRelayout.
https://bugs.webkit.org/show_bug.cgi?id=91368
Reviewed by Levi Weintraub.
We were calling setNeedsLayoutAndPrefWidthsRecalc() in RenderBlock::collapseAnonymousBoxChild
even when documentBeingDestroyed() was true. This ends up accessing stale layout root and bypasses
mitigation added in r109406. There is no need to waste time merging up anonymous blocks in
RenderBlock::removeChild when documentBeingDestroyed() is true.
No new tests. The test is time sensitive, requires a bunch of reloads, and only reproduces on chromium linux.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::collapseAnonymousBoxChild):
(WebCore::RenderBlock::removeChild):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (125314 => 125315)
--- trunk/Source/WebCore/ChangeLog 2012-08-10 19:38:59 UTC (rev 125314)
+++ trunk/Source/WebCore/ChangeLog 2012-08-10 19:41:20 UTC (rev 125315)
@@ -1,3 +1,21 @@
+2012-08-10 Abhishek Arya <[email protected]>
+
+ Crash on accessing a removed layout root in FrameView::scheduleRelayout.
+ https://bugs.webkit.org/show_bug.cgi?id=91368
+
+ Reviewed by Levi Weintraub.
+
+ We were calling setNeedsLayoutAndPrefWidthsRecalc() in RenderBlock::collapseAnonymousBoxChild
+ even when documentBeingDestroyed() was true. This ends up accessing stale layout root and bypasses
+ mitigation added in r109406. There is no need to waste time merging up anonymous blocks in
+ RenderBlock::removeChild when documentBeingDestroyed() is true.
+
+ No new tests. The test is time sensitive, requires a bunch of reloads, and only reproduces on chromium linux.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::collapseAnonymousBoxChild):
+ (WebCore::RenderBlock::removeChild):
+
2012-08-10 Dan Bernstein <[email protected]>
<rdar://problem/11855229> When in paginated mode, the layout timer fires continually
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (125314 => 125315)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-08-10 19:38:59 UTC (rev 125314)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-08-10 19:41:20 UTC (rev 125315)
@@ -1139,15 +1139,21 @@
RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
anonBlock->moveAllChildrenTo(parent, nextSibling, child->hasLayer());
// Delete the now-empty block's lines and nuke it.
- if (!parent->documentBeingDestroyed())
- anonBlock->deleteLineBoxTree();
- if (!parent->documentBeingDestroyed() && childFlowThread && childFlowThread->isRenderNamedFlowThread())
+ anonBlock->deleteLineBoxTree();
+ if (childFlowThread && childFlowThread->isRenderNamedFlowThread())
toRenderNamedFlowThread(childFlowThread)->removeFlowChildInfo(anonBlock);
anonBlock->destroy();
}
void RenderBlock::removeChild(RenderObject* oldChild)
{
+ // No need to waste time in merging or removing empty anonymous blocks.
+ // We can just bail out if our document is getting destroyed.
+ if (documentBeingDestroyed()) {
+ RenderBox::removeChild(oldChild);
+ return;
+ }
+
// If this child is a block, and if our previous and next siblings are
// both anonymous blocks with inline content, then we can go ahead and
// fold the inline content back together.
@@ -1217,7 +1223,7 @@
}
}
- if (!firstChild() && !documentBeingDestroyed()) {
+ if (!firstChild()) {
// If this was our last child be sure to clear out our line boxes.
if (childrenInline())
deleteLineBoxTree();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
