⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 100051 in webkit


Ignore:
Timestamp:
Nov 11, 2011, 5:26:22 PM (15 years ago)
Author:
jchaffraix@webkit.org
Message:

Crash in styleDidChange when changing a table cell's height.
<​http://webkit.org/b/72004>

Reviewed by Darin Adler.

Source/WebCore:

Tests: fast/table/crash-table-cell-change-height.html

fast/table/table-cell-change-height-with-needsCellRecalc-section.html
fast/table/table-cell-change-last-row-with-needsCellRecalc-section.html
fast/table/table-row-change-height-with-needsCellRecalc-section.html

r99212 removed our call to recalcCells when the logical height changed. This
means that we could end up with a cells without having set its row() properly
which would crash.

The change exposes the was-the-row-properly-set information so that we don't
try to access a bogus index. This should work properly even if the section
needs a cell recalc as the current section's row structure would still be
accurate in this case.

  • rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::styleDidChange): Check that our row index
was properly set before calling

  • rendering/RenderTableCell.h:

(WebCore::RenderTableCell::rowWasSet): Helper function to detect
if we have set up our a row.
(WebCore::RenderTableCell::row): Use the previous function in the
ASSERT.

LayoutTests:

  • fast/table/crash-table-cell-change-height-expected.txt: Added.
  • fast/table/crash-table-cell-change-height.html: Added.
  • fast/table/table-cell-change-height-with-needsCellRecalc-section-expected.txt: Added.
  • fast/table/table-cell-change-height-with-needsCellRecalc-section.html: Added.
  • fast/table/table-cell-change-last-row-with-needsCellRecalc-section-expected.txt: Added.
  • fast/table/table-cell-change-last-row-with-needsCellRecalc-section.html: Added.
  • fast/table/table-row-change-height-with-needsCellRecalc-section-expected.txt: Added.
  • fast/table/table-row-change-height-with-needsCellRecalc-section.html: Added.

Those tests checks that we don't try to access bad rows when the section needs a recalc.

Location:
trunk
Files:
8 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r100050 r100051  
     12011-11-11  Julien Chaffraix  <jchaffraix@webkit.org>
     2
     3        Crash in styleDidChange when changing a table cell's height.
     4        <http://webkit.org/b/72004>
     5
     6        Reviewed by Darin Adler.
     7
     8        * fast/table/crash-table-cell-change-height-expected.txt: Added.
     9        * fast/table/crash-table-cell-change-height.html: Added.
     10
     11        * fast/table/table-cell-change-height-with-needsCellRecalc-section-expected.txt: Added.
     12        * fast/table/table-cell-change-height-with-needsCellRecalc-section.html: Added.
     13        * fast/table/table-cell-change-last-row-with-needsCellRecalc-section-expected.txt: Added.
     14        * fast/table/table-cell-change-last-row-with-needsCellRecalc-section.html: Added.
     15        * fast/table/table-row-change-height-with-needsCellRecalc-section-expected.txt: Added.
     16        * fast/table/table-row-change-height-with-needsCellRecalc-section.html: Added.
     17        Those tests checks that we don't try to access bad rows when the section needs a recalc.
     18
    1192011-11-11  Shinya Kawanaka  <shinyak@google.com>
    220

  • trunk/Source/WebCore/ChangeLog

    r100050 r100051  
     12011-11-11  Julien Chaffraix  <jchaffraix@webkit.org>
     2
     3        Crash in styleDidChange when changing a table cell's height.
     4        <http://webkit.org/b/72004>
     5
     6        Reviewed by Darin Adler.
     7
     8        Tests: fast/table/crash-table-cell-change-height.html
     9               fast/table/table-cell-change-height-with-needsCellRecalc-section.html
     10               fast/table/table-cell-change-last-row-with-needsCellRecalc-section.html
     11               fast/table/table-row-change-height-with-needsCellRecalc-section.html
     12
     13        r99212 removed our call to recalcCells when the logical height changed. This
     14        means that we could end up with a cells without having set its row() properly
     15        which would crash.
     16
     17        The change exposes the was-the-row-properly-set information so that we don't
     18        try to access a bogus index. This should work properly even if the section
     19        needs a cell recalc as the current section's row structure would still be
     20        accurate in this case.
     21
     22        * rendering/RenderTableCell.cpp:
     23        (WebCore::RenderTableCell::styleDidChange): Check that our row index
     24        was properly set before calling
     25
     26        * rendering/RenderTableCell.h:
     27        (WebCore::RenderTableCell::rowWasSet): Helper function to detect
     28        if we have set up our a row.
     29        (WebCore::RenderTableCell::row): Use the previous function in the
     30        ASSERT.
     31
    1322011-11-11  Shinya Kawanaka  <shinyak@google.com>
    233

  • trunk/Source/WebCore/rendering/RenderTableCell.cpp

    r99254 r100051  
    318318    setHasBoxDecorations(true);
    319319
    320     if (parent() && section() && oldStyle && style()->height() != oldStyle->height())
     320    if (parent() && section() && oldStyle && style()->height() != oldStyle->height() && rowWasSet())
    321321        section()->rowLogicalHeightChanged(row());
    322322

  • trunk/Source/WebCore/rendering/RenderTableCell.h

    r99254 r100051  
    7272    }
    7373
     74    bool rowWasSet() const { return m_row != unsetRowIndex; }
    7475    unsigned row() const
    7576    {
    76         ASSERT(m_row != unsetRowIndex);
     77        ASSERT(rowWasSet());
    7778        return m_row;
    7879    }
Note: See TracChangeset for help on using the changeset viewer.