Changeset 107331 in webkit

Timestamp:

Feb 9, 2012, 5:48:11 PM (15 years ago)

Author:

cevans@google.com

Message:

Merge 106852
BUG=106336
Review URL: ​https://chromiumcodereview.appspot.com/9373051

Location:

branches/chromium/1025

Files:

• LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash-expected.txt )
• LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash.html (copied) (copied from trunk/LayoutTests/fast/css/counters/reparent-table-children-with-counters-crash.html )
• Source/WebCore/rendering/RenderCounter.cpp (modified) (5 diffs)

branches/chromium/1025/Source/WebCore/rendering/RenderCounter.cpp

@@ -302 +302 @@
 // - Non-reset CounterNodes cannot have descendants.
 
-static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
+static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, RefPtr<CounterNode>& parent, RefPtr<CounterNode>& previousSibling)
 {
     // We cannot stop searching for counters with the same identifier before we also
@@ -347 +347 @@
                         // If the node we are placing is not reset or we have found a counter that is attached
                         // to an ancestor of the placed counter's owner renderer we know we are a sibling of that node.
-                        ASSERT(currentCounter->parent() == previousSiblingProtector->parent());
+                        if (currentCounter->parent() != previousSiblingProtector->parent())
+                            return false;
+
                         parent = currentCounter->parent();
                         previousSibling = previousSiblingProtector.get();
@@ -429 +431 @@
         return 0;
 
-    CounterNode* newParent = 0;
-    CounterNode* newPreviousSibling = 0;
+    RefPtr<CounterNode> newParent = 0;
+    RefPtr<CounterNode> newPreviousSibling = 0;
     RefPtr<CounterNode> newNode = CounterNode::create(object, isReset, value);
     if (findPlaceForCounter(object, identifier, isReset, newParent, newPreviousSibling))
-        newParent->insertAfter(newNode.get(), newPreviousSibling, identifier);
+        newParent->insertAfter(newNode.get(), newPreviousSibling.get(), identifier);
     CounterMap* nodeMap;
     if (object->hasCounterNodeMap())
@@ -629 +631 @@
             continue;
         }
-        CounterNode* newParent = 0;
-        CounterNode* newPreviousSibling;
+        RefPtr<CounterNode> newParent = 0;
+        RefPtr<CounterNode> newPreviousSibling = 0;
         
         findPlaceForCounter(renderer, AtomicString(it->first.get()), node->hasResetType(), newParent, newPreviousSibling);
@@ -641 +643 @@
             parent->removeChild(node.get());
         if (newParent)
-            newParent->insertAfter(node.get(), newPreviousSibling, it->first.get());
+            newParent->insertAfter(node.get(), newPreviousSibling.get(), it->first.get());
     }
 }