Title: [134107] branches/safari-536.28-branch
Diff
Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (134106 => 134107)
--- branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-09 21:43:22 UTC (rev 134106)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-09 21:50:14 UTC (rev 134107)
@@ -1,5 +1,19 @@
2012-11-09 Lucas Forschler <[email protected]>
+ Merge r126251.
+
+ 2012-08-21 Julien Chaffraix <[email protected]>
+
+ Crash in RenderTableSection::setCellLogicalWidths
+ https://bugs.webkit.org/show_bug.cgi?id=94291
+
+ Reviewed by Abhishek Arya.
+
+ * fast/table/crash-split-table-section-no-cell-recalc-expected.txt: Added.
+ * fast/table/crash-split-table-section-no-cell-recalc.html: Added.
+
+2012-11-09 Lucas Forschler <[email protected]>
+
Merge r125635
2012-08-14 Ojan Vafai <[email protected]>
Added: branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc-expected.txt (0 => 134107)
--- branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc-expected.txt 2012-11-09 21:50:14 UTC (rev 134107)
@@ -0,0 +1,2 @@
+94291: Crash in RenderTableSection::setCellLogicalWidths
+This test has PASSED as it didn't CRASH or ASSERT.
Property changes on: branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc-expected.txt
___________________________________________________________________
Added: svn:mime-type
Added: svn:keywords
Added: svn:eol-style
Added: branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc.html (0 => 134107)
--- branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc.html 2012-11-09 21:50:14 UTC (rev 134107)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+A<div></div>
+<div id="div1"></div>
+<style>
+* { display: table-cell; }
+.class1 { -webkit-appearance: sliderthumb-vertical; }
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+document.addEventListener("DOMContentLoaded", crash, false);
+function crash() {
+ div1 = document.getElementById("div1");
+ div1.style.display = "table-row-group";
+ document.documentElement.offsetTop;
+ div1.setAttribute("class", "class1");
+ document.documentElement.offsetTop;
+ document.documentElement.innerHTML = "<a href=''>94291</a>: Crash in RenderTableSection::setCellLogicalWidths<br/>This test has PASSED as it didn't CRASH or ASSERT.";
+}
+</script>
+</html>
Property changes on: branches/safari-536.28-branch/LayoutTests/fast/table/crash-split-table-section-no-cell-recalc.html
___________________________________________________________________
Added: svn:mime-type
Added: svn:keywords
Added: svn:eol-style
Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (134106 => 134107)
--- branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-09 21:43:22 UTC (rev 134106)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-09 21:50:14 UTC (rev 134107)
@@ -1,5 +1,29 @@
2012-11-09 Lucas Forschler <[email protected]>
+ Merge r126251.
+
+ 2012-08-21 Julien Chaffraix <[email protected]>
+
+ Crash in RenderTableSection::setCellLogicalWidths
+ https://bugs.webkit.org/show_bug.cgi?id=94291
+
+ Reviewed by Abhishek Arya.
+
+ This issue was that splitAnonymousBoxesAroundChild would move a table section
+ into a newly created table *without* marking it as needing cell recalc. The table
+ would thus never build its structure to match its sections. The fix is to hop on
+ the new willBeRemovedFromTree signal so that the section invalidates itself properly.
+
+ Test: fast/table/crash-split-table-section-no-cell-recalc.html
+
+ * rendering/RenderTableSection.cpp:
+ (WebCore::RenderTableSection::willBeRemovedFromTree):
+ * rendering/RenderTableSection.h:
+ Replaced willBeDestroyed by willBeRemovedFromTree in RenderTableSection. This ensures that it is called
+ when moving sections in the tree to mark them as needing cell recalc.
+
+2012-11-09 Lucas Forschler <[email protected]>
+
Merge r126048.
Prerequisite for <rdar://problem/12536470>
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderTableSection.cpp (134106 => 134107)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderTableSection.cpp 2012-11-09 21:43:22 UTC (rev 134106)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderTableSection.cpp 2012-11-09 21:50:14 UTC (rev 134107)
@@ -114,16 +114,13 @@
table->invalidateCollapsedBorders();
}
-void RenderTableSection::willBeDestroyed()
+void RenderTableSection::willBeRemovedFromTree()
{
- RenderTable* recalcTable = table();
-
- RenderBox::willBeDestroyed();
-
- // recalc cell info because RenderTable has unguarded pointers
- // stored that point to this RenderTableSection.
- if (recalcTable)
- recalcTable->setNeedsSectionRecalc();
+ RenderBox::willBeRemovedFromTree();
+
+ // Preventively invalidate our cells as we may be re-inserted into
+ // a new table which would require us to rebuild our structure.
+ setNeedsCellRecalc();
}
void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild)
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderTableSection.h (134106 => 134107)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderTableSection.h 2012-11-09 21:43:22 UTC (rev 134106)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderTableSection.h 2012-11-09 21:50:14 UTC (rev 134107)
@@ -177,7 +177,7 @@
virtual bool isTableSection() const { return true; }
- virtual void willBeDestroyed();
+ virtual void willBeRemovedFromTree() OVERRIDE;
virtual void layout();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
