[webkit-changes] [158065] branches/safari-537.73-branch

Fri, 25 Oct 2013 16:02:33 -0700

Title: [158065] branches/safari-537.73-branch

Diff

Modified: branches/safari-537.73-branch/LayoutTests/ChangeLog (158064 => 158065)


--- branches/safari-537.73-branch/LayoutTests/ChangeLog	2013-10-25 22:52:19 UTC (rev 158064)
+++ branches/safari-537.73-branch/LayoutTests/ChangeLog	2013-10-25 23:03:22 UTC (rev 158065)
@@ -1,5 +1,23 @@
 2013-10-25  Lucas Forschler  <[email protected]>
 
+        Merge r155608
+
+    2013-09-12  Zalan Bujtas  <[email protected]>
+
+            Crash in ScrollingStateStickyNode::updateConstraints
+            https://bugs.webkit.org/show_bug.cgi?id=119638
+
+            Reviewed by Simon Fraser.
+
+            Ensure when a scrolling state node is removed from the state tree,
+            we remove both the current node and all its children from the
+            associated m_stateNodeMap lookup table.
+
+            * fast/css/sticky/multiple-layers-sticky-crash-expected.txt: Added.
+            * fast/css/sticky/multiple-layers-sticky-crash.html: Added.
+
+2013-10-25  Lucas Forschler  <[email protected]>
+
         Merge r155546
 
     2013-09-10  Simon Fraser  <[email protected]>

Copied: branches/safari-537.73-branch/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash-expected.txt (from rev 155608, trunk/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash-expected.txt) (0 => 158065)


--- branches/safari-537.73-branch/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash-expected.txt	                        (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash-expected.txt	2013-10-25 23:03:22 UTC (rev 158065)
@@ -0,0 +1,3 @@
+PASS if no crash or assert.
+
+

Copied: branches/safari-537.73-branch/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash.html (from rev 155608, trunk/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash.html) (0 => 158065)


--- branches/safari-537.73-branch/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash.html	                        (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/css/sticky/multiple-layers-sticky-crash.html	2013-10-25 23:03:22 UTC (rev 158065)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+  </script>
+
+  <style>
+    div:last-child {
+      padding: 0px;
+    }
+
+    div {
+      position: -webkit-sticky;
+    }
+  </style>
+</head>
+<body>
+  <p>PASS if no crash or assert.</p>
+  <p>
+    <div>
+      <div>
+        <div></div>
+     </div>
+    </div>
+  </p>
+</body>
+</html>

Modified: branches/safari-537.73-branch/Source/WebCore/ChangeLog (158064 => 158065)


--- branches/safari-537.73-branch/Source/WebCore/ChangeLog	2013-10-25 22:52:19 UTC (rev 158064)
+++ branches/safari-537.73-branch/Source/WebCore/ChangeLog	2013-10-25 23:03:22 UTC (rev 158065)
@@ -1,5 +1,27 @@
 2013-10-25  Lucas Forschler  <[email protected]>
 
+        Merge r155608
+
+    2013-09-12  Zalan Bujtas  <[email protected]>
+
+            Crash in ScrollingStateStickyNode::updateConstraints
+            https://bugs.webkit.org/show_bug.cgi?id=119638
+
+            Reviewed by Simon Fraser.
+
+            Ensure when a scrolling state node is removed from the state tree,
+            we remove both the current node and all its children from the
+            associated m_stateNodeMap lookup table.
+
+            Test: fast/css/sticky/multiple-layers-sticky-crash.html
+
+            * page/scrolling/ScrollingStateNode.cpp:
+            (WebCore::ScrollingStateNode::removeChild):
+            (WebCore::ScrollingStateNode::willBeRemovedFromStateTree):
+            * page/scrolling/ScrollingStateNode.h:
+
+2013-10-25  Lucas Forschler  <[email protected]>
+
         Merge r155546
 
     2013-09-10  Simon Fraser  <[email protected]>

Modified: branches/safari-537.73-branch/Source/WebCore/page/scrolling/ScrollingStateNode.cpp (158064 => 158065)


--- branches/safari-537.73-branch/Source/WebCore/page/scrolling/ScrollingStateNode.cpp	2013-10-25 22:52:19 UTC (rev 158064)
+++ branches/safari-537.73-branch/Source/WebCore/page/scrolling/ScrollingStateNode.cpp	2013-10-25 23:03:22 UTC (rev 158065)
@@ -102,7 +102,7 @@
     // The index will be notFound if the node to remove is a deeper-than-1-level descendant or
     // if node is the root state node.
     if (index != notFound) {
-        m_scrollingStateTree->didRemoveNode(node->scrollingNodeID());
+        node->willBeRemovedFromStateTree();
         m_children->remove(index);
         return;
     }
@@ -112,6 +112,20 @@
         m_children->at(i)->removeChild(node);
 }
 
+void ScrollingStateNode::willBeRemovedFromStateTree()
+{
+    ASSERT(m_scrollingStateTree);
+
+    m_scrollingStateTree->didRemoveNode(scrollingNodeID());
+
+    if (!m_children)
+        return;
+
+    size_t size = m_children->size();
+    for (size_t i = 0; i < size; ++i)
+        m_children->at(i)->willBeRemovedFromStateTree();
+}
+
 void ScrollingStateNode::writeIndent(TextStream& ts, int indent)
 {
     for (int i = 0; i != indent; ++i)

Modified: branches/safari-537.73-branch/Source/WebCore/page/scrolling/ScrollingStateNode.h (158064 => 158065)


--- branches/safari-537.73-branch/Source/WebCore/page/scrolling/ScrollingStateNode.h	2013-10-25 22:52:19 UTC (rev 158064)
+++ branches/safari-537.73-branch/Source/WebCore/page/scrolling/ScrollingStateNode.h	2013-10-25 23:03:22 UTC (rev 158065)
@@ -101,6 +101,7 @@
 
     virtual void dumpProperties(TextStream&, int indent) const = 0;
     ChangedProperties changedProperties() const { return m_changedProperties; }
+    void willBeRemovedFromStateTree();
 
     ScrollingNodeID m_nodeID;
     ChangedProperties m_changedProperties;

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to