Title: [179877] trunk
- Revision
- 179877
- Author
- [email protected]
- Date
- 2015-02-10 12:27:40 -0800 (Tue, 10 Feb 2015)
Log Message
REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
https://bugs.webkit.org/show_bug.cgi?id=133462
Reviewed by David Hyatt.
RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
we detach the inline tree first and destroy them after. The detached root boxes can't access
the flowthread containing block and we end up with dangling pointers in this map.
Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.
Source/WebCore:
Test: fast/multicol/newmulticol/crash-when-switching-to-floating.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::collapseAnonymousBoxChild):
LayoutTests:
* fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt: Added.
* fast/multicol/newmulticol/crash-when-switching-to-floating.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (179876 => 179877)
--- trunk/LayoutTests/ChangeLog 2015-02-10 20:26:50 UTC (rev 179876)
+++ trunk/LayoutTests/ChangeLog 2015-02-10 20:27:40 UTC (rev 179877)
@@ -1,3 +1,19 @@
+2015-02-07 Zalan Bujtas <[email protected]>
+
+ REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
+ https://bugs.webkit.org/show_bug.cgi?id=133462
+
+ Reviewed by David Hyatt.
+
+ RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
+ Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
+ we detach the inline tree first and destroy them after. The detached root boxes can't access
+ the flowthread containing block and we end up with dangling pointers in this map.
+ Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.
+
+ * fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt: Added.
+ * fast/multicol/newmulticol/crash-when-switching-to-floating.html: Added.
+
2015-02-10 David Kilzer <[email protected]>
[iOS] Gardening: fast/loader/subframe-navigate-during-main-frame-load.html crashes running all tests
Added: trunk/LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt (0 => 179877)
--- trunk/LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt 2015-02-10 20:27:40 UTC (rev 179877)
@@ -0,0 +1 @@
+Pass if no crash or assert in debug build.
Added: trunk/LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating.html (0 => 179877)
--- trunk/LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating.html 2015-02-10 20:27:40 UTC (rev 179877)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we clean up the inline content properly after introducing floating.</title>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<table><td></table>
+Pass if no crash or assert in debug build.
+<script>
+var head = document.getElementsByTagName("head")[0];
+style = document.createElement("style");
+style.innerHTML="* { \n\
+-webkit-animation-name: name9; \n\
+-webkit-animation-duration: 10s; \n\
+} \n\
+@-webkit-keyframes name9 { \n\
+ from { \n\
+ } \n\
+ to { \n\
+ -webkit-column-width: auto; \n\
+";
+head.appendChild(style);
+document.execCommand("SelectAll");
+style.innerHTML="* {float:left;}";
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (179876 => 179877)
--- trunk/Source/WebCore/ChangeLog 2015-02-10 20:26:50 UTC (rev 179876)
+++ trunk/Source/WebCore/ChangeLog 2015-02-10 20:27:40 UTC (rev 179877)
@@ -1,3 +1,21 @@
+2015-02-07 Zalan Bujtas <[email protected]>
+
+ REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
+ https://bugs.webkit.org/show_bug.cgi?id=133462
+
+ Reviewed by David Hyatt.
+
+ RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
+ Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
+ we detach the inline tree first and destroy them after. The detached root boxes can't access
+ the flowthread containing block and we end up with dangling pointers in this map.
+ Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.
+
+ Test: fast/multicol/newmulticol/crash-when-switching-to-floating.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::collapseAnonymousBoxChild):
+
2015-02-10 Julien Isorce <[email protected]>
Render: properly update body's background image
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (179876 => 179877)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2015-02-10 20:26:50 UTC (rev 179876)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2015-02-10 20:27:40 UTC (rev 179877)
@@ -672,9 +672,8 @@
parent.setChildrenInline(child->childrenInline());
RenderObject* nextSibling = child->nextSibling();
- RenderFlowThread* childFlowThread = child->flowThreadContainingBlock();
- if (is<RenderNamedFlowThread>(childFlowThread))
- downcast<RenderNamedFlowThread>(*childFlowThread).removeFlowChildInfo(child);
+ if (auto* childFlowThread = child->flowThreadContainingBlock())
+ childFlowThread->removeFlowChildInfo(child);
parent.removeChildInternal(*child, child->hasLayer() ? NotifyChildren : DontNotifyChildren);
child->moveAllChildrenTo(&parent, nextSibling, child->hasLayer());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
