Diff
Modified: trunk/LayoutTests/ChangeLog (142884 => 142885)
--- trunk/LayoutTests/ChangeLog 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/LayoutTests/ChangeLog 2013-02-14 17:23:48 UTC (rev 142885)
@@ -1,3 +1,16 @@
+2013-02-14 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r142820.
+ http://trac.webkit.org/changeset/142820
+ https://bugs.webkit.org/show_bug.cgi?id=109839
+
+ Causing crashes on chromium canaries (Requested by atwilson_
+ on #webkit).
+
+ * fast/block/float/float-not-removed-from-pre-block-expected.txt:
+ * fast/css-generated-content/quote-layout-focus-crash-expected.txt: Removed.
+ * fast/css-generated-content/quote-layout-focus-crash.html: Removed.
+
2013-02-14 Mario Sanchez Prada <[email protected]>
[GTK] Missing call to g_object_ref while retrieving accessible table cells
Modified: trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt (142884 => 142885)
--- trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt 2013-02-14 17:23:48 UTC (rev 142885)
@@ -1,3 +1,3 @@
Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
Test passes if it does not crash.
-
+
Deleted: trunk/LayoutTests/fast/css-generated-content/quote-layout-focus-crash-expected.txt (142884 => 142885)
--- trunk/LayoutTests/fast/css-generated-content/quote-layout-focus-crash-expected.txt 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/LayoutTests/fast/css-generated-content/quote-layout-focus-crash-expected.txt 2013-02-14 17:23:48 UTC (rev 142885)
@@ -1,3 +0,0 @@
-Bug 109616 - ASSERT(!renderer()->needsLayout()) when calling Element::focus() with generated content
-
-
Deleted: trunk/LayoutTests/fast/css-generated-content/quote-layout-focus-crash.html (142884 => 142885)
--- trunk/LayoutTests/fast/css-generated-content/quote-layout-focus-crash.html 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/LayoutTests/fast/css-generated-content/quote-layout-focus-crash.html 2013-02-14 17:23:48 UTC (rev 142885)
@@ -1,47 +0,0 @@
-<!DOCTYPE html>
-
-<style>
- /* Must be positioned absolute or static, must have margins to push it out view. */
- .positioned {
- position: absolute;
- margin-top: 100%;
- }
-
- /* Any kind of quote will do, can be either :before or :after */
- .positioned:before,
- .focusable:before {
- content: open-quote;
- }
-</style>
-
-<p>Bug 109616 - ASSERT(!renderer()->needsLayout()) when calling Element::focus() with generated content</p>
-
-<!--
- This is testing a case where RenderQuote::updateDepth will mark the RenderQuote
- and its ancestors as needing layout in the middle of a layout of its ancestor.
- When its ancestor finishes the layout it will mark itself and the ancestors
- farther up as no longer needing layout. The end result is some subtree
- needing layout, but the RenderView and possibly other ancestors of the subtree
- not needing layout.
-
- ex.
-
- RenderView <- !needsLayout
- \
- RenderBlock (.focusable) <- needsLayout
- \
- RenderBlock (generated content) <- needsLayout
- \
- RenderQuote <- needsLayout
--->
-
-<div class="positioned"></div>
-<div class="focusable" tabindex="1"></div>
-
-<script>
- if (window.testRunner)
- testRunner.dumpAsText();
- // .focusable still needs layout at this point, but RenderView doesn't
- // think any descendants need layout.
- document.querySelector('.focusable').focus();
-</script>
Modified: trunk/Source/WebCore/ChangeLog (142884 => 142885)
--- trunk/Source/WebCore/ChangeLog 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/Source/WebCore/ChangeLog 2013-02-14 17:23:48 UTC (rev 142885)
@@ -1,3 +1,20 @@
+2013-02-14 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r142820.
+ http://trac.webkit.org/changeset/142820
+ https://bugs.webkit.org/show_bug.cgi?id=109839
+
+ Causing crashes on chromium canaries (Requested by atwilson_
+ on #webkit).
+
+ * dom/Document.cpp:
+ (WebCore::Document::updateLayout):
+ (WebCore::Document::implicitClose):
+ * rendering/RenderQuote.h:
+ (RenderQuote):
+ * rendering/RenderView.cpp:
+ * rendering/RenderView.h:
+
2013-02-14 Mario Sanchez Prada <[email protected]>
[GTK] Missing call to g_object_ref while retrieving accessible table cells
Modified: trunk/Source/WebCore/dom/Document.cpp (142884 => 142885)
--- trunk/Source/WebCore/dom/Document.cpp 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/Source/WebCore/dom/Document.cpp 2013-02-14 17:23:48 UTC (rev 142885)
@@ -1884,9 +1884,6 @@
StackStats::LayoutCheckPoint layoutCheckPoint;
- if (renderView())
- renderView()->markQuoteContainingBlocksForLayoutIfNeeded();
-
// Only do a layout if changes have occurred that make it necessary.
if (frameView && renderer() && (frameView->layoutPending() || renderer()->needsLayout()))
frameView->layout();
@@ -2439,10 +2436,7 @@
m_overMinimumLayoutThreshold = true;
if (!ownerElement() || (ownerElement()->renderer() && !ownerElement()->renderer()->needsLayout())) {
updateStyleIfNeeded();
-
- if (renderView())
- renderView()->markQuoteContainingBlocksForLayoutIfNeeded();
-
+
// Always do a layout after loading if needed.
if (view() && renderObject && (!renderObject->firstChild() || renderObject->needsLayout()))
view()->layout();
Modified: trunk/Source/WebCore/rendering/RenderQuote.h (142884 => 142885)
--- trunk/Source/WebCore/rendering/RenderQuote.h 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/Source/WebCore/rendering/RenderQuote.h 2013-02-14 17:23:48 UTC (rev 142885)
@@ -38,8 +38,6 @@
void attachQuote();
void detachQuote();
- RenderQuote* next() { return m_next; }
-
private:
virtual void willBeDestroyed() OVERRIDE;
virtual const char* renderName() const OVERRIDE { return "RenderQuote"; };
Modified: trunk/Source/WebCore/rendering/RenderView.cpp (142884 => 142885)
--- trunk/Source/WebCore/rendering/RenderView.cpp 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/Source/WebCore/rendering/RenderView.cpp 2013-02-14 17:23:48 UTC (rev 142885)
@@ -36,7 +36,6 @@
#include "RenderLayer.h"
#include "RenderLayerBacking.h"
#include "RenderNamedFlowThread.h"
-#include "RenderQuote.h"
#include "RenderSelectionInfo.h"
#include "RenderWidget.h"
#include "RenderWidgetProtector.h"
@@ -1069,18 +1068,6 @@
return m_intervalArena.get();
}
-void RenderView::markQuoteContainingBlocksForLayoutIfNeeded()
-{
- for (RenderQuote* quote = m_renderQuoteHead; quote; quote = quote->next()) {
- if (!quote->needsLayout())
- continue;
- // Can't use markContainingBlocksForLayout because it would abort as soon
- // as it sees a parent that already thinks it needs layout.
- for (RenderObject* renderer = quote->parent(); renderer; renderer = renderer->parent())
- renderer->setChildNeedsLayout(true, MarkOnlyThis);
- }
-}
-
void RenderView::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
{
MemoryClassInfo info(memoryObjectInfo, this, PlatformMemoryTypes::Rendering);
Modified: trunk/Source/WebCore/rendering/RenderView.h (142884 => 142885)
--- trunk/Source/WebCore/rendering/RenderView.h 2013-02-14 17:21:28 UTC (rev 142884)
+++ trunk/Source/WebCore/rendering/RenderView.h 2013-02-14 17:23:48 UTC (rev 142885)
@@ -230,11 +230,6 @@
void removeRenderCounter() { ASSERT(m_renderCounterCount > 0); m_renderCounterCount--; }
bool hasRenderCounters() { return m_renderCounterCount; }
- // FIXME: This is a hack until we have proper pre layout tasks to handle quote attachment.
- // See RenderQuote::updateDepth for more details about what this is a workaround for.
- // See: https://bugs.webkit.org/show_bug.cgi?id=109628
- void markQuoteContainingBlocksForLayoutIfNeeded();
-
protected:
virtual void mapLocalToContainer(const RenderLayerModelObject* repaintContainer, TransformState&, MapCoordinatesFlags = ApplyContainerFlip, bool* wasFixed = 0) const OVERRIDE;
virtual const RenderObject* pushMappingToContainer(const RenderLayerModelObject* ancestorToStopAt, RenderGeometryMap&) const OVERRIDE;
