Title: [195275] releases/WebKitGTK/webkit-2.10
- Revision
- 195275
- Author
- [email protected]
- Date
- 2016-01-19 01:39:14 -0800 (Tue, 19 Jan 2016)
Log Message
Merge r195146 - ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
https://bugs.webkit.org/show_bug.cgi?id=123331
Reviewed by Darin Adler.
Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
Source/WebCore:
Test: fast/regions/input-box-with-region-assert.html
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
(WebCore::RenderBlockFlow::setRenderNamedFlowFragment):
LayoutTests:
* fast/regions/input-box-with-region-assert-expected.txt: Added.
* fast/regions/input-box-with-region-assert.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195274 => 195275)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 09:37:58 UTC (rev 195274)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog 2016-01-19 09:39:14 UTC (rev 195275)
@@ -1,3 +1,16 @@
+2016-01-15 Zalan Bujtas <[email protected]>
+
+ ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
+ https://bugs.webkit.org/show_bug.cgi?id=123331
+
+ Reviewed by Darin Adler.
+
+ Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
+ could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
+
+ * fast/regions/input-box-with-region-assert-expected.txt: Added.
+ * fast/regions/input-box-with-region-assert.html: Added.
+
2016-01-15 Youenn Fablet <[email protected]>
CORS: Fix the handling of redirected request containing Origin null.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/fast/regions/input-box-with-region-assert-expected.txt (0 => 195275)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/fast/regions/input-box-with-region-assert-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/fast/regions/input-box-with-region-assert-expected.txt 2016-01-19 09:39:14 UTC (rev 195275)
@@ -0,0 +1 @@
+Pass if no crash or assert in debug.
Added: releases/WebKitGTK/webkit-2.10/LayoutTests/fast/regions/input-box-with-region-assert.html (0 => 195275)
--- releases/WebKitGTK/webkit-2.10/LayoutTests/fast/regions/input-box-with-region-assert.html (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/fast/regions/input-box-with-region-assert.html 2016-01-19 09:39:14 UTC (rev 195275)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that flow child can be added to an input element.</title>
+</head>
+<body>
+Pass if no crash or assert in debug.
+<input style="-webkit-flow-from: thread">
+</body>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</html>
\ No newline at end of file
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195274 => 195275)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 09:37:58 UTC (rev 195274)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-19 09:39:14 UTC (rev 195275)
@@ -1,3 +1,20 @@
+2016-01-15 Zalan Bujtas <[email protected]>
+
+ ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
+ https://bugs.webkit.org/show_bug.cgi?id=123331
+
+ Reviewed by Darin Adler.
+
+ Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
+ could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
+
+ Test: fast/regions/input-box-with-region-assert.html
+
+ * rendering/RenderBlockFlow.cpp:
+ (WebCore::RenderBlockFlow::willBeDestroyed):
+ (WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
+ (WebCore::RenderBlockFlow::setRenderNamedFlowFragment):
+
2016-01-15 Youenn Fablet <[email protected]>
CORS: Fix the handling of redirected request containing Origin null.
Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderBlockFlow.cpp (195274 => 195275)
--- releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderBlockFlow.cpp 2016-01-19 09:37:58 UTC (rev 195274)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderBlockFlow.cpp 2016-01-19 09:39:14 UTC (rev 195275)
@@ -144,7 +144,7 @@
void RenderBlockFlow::willBeDestroyed()
{
if (renderNamedFlowFragment())
- setRenderNamedFlowFragment(0);
+ setRenderNamedFlowFragment(nullptr);
// Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
// properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
@@ -3140,8 +3140,8 @@
if (style().isDisplayRegionType() && style().hasFlowFrom() && !style().specifiesColumns()) {
RenderNamedFlowFragment* flowFragment = new RenderNamedFlowFragment(document(), RenderNamedFlowFragment::createStyle(style()));
flowFragment->initializeStyle();
+ addChild(flowFragment);
setRenderNamedFlowFragment(flowFragment);
- addChild(renderNamedFlowFragment());
}
}
@@ -3187,8 +3187,8 @@
void RenderBlockFlow::setRenderNamedFlowFragment(RenderNamedFlowFragment* flowFragment)
{
RenderBlockFlowRareData& rareData = ensureRareBlockFlowData();
- if (rareData.m_renderNamedFlowFragment)
- rareData.m_renderNamedFlowFragment->destroy();
+ if (auto* flowFragmentOnFlow = std::exchange(rareData.m_renderNamedFlowFragment, nullptr))
+ flowFragmentOnFlow->destroy();
rareData.m_renderNamedFlowFragment = flowFragment;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
