Changeset 133346 in webkit

Timestamp:

Nov 2, 2012, 2:26:52 PM (12 years ago)

Author:

Lucas Forschler

Message:

Merged r124564. <rdar://problem/12536416>

Location:

branches/safari-536.28-branch

Files:

• LayoutTests/ChangeLog (modified) (2 diffs)
• LayoutTests/fast/block/layer-not-removed-from-parent-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/block/layer-not-removed-from-parent-crash-expected.txt )
• LayoutTests/fast/block/layer-not-removed-from-parent-crash.html (copied) (copied from trunk/LayoutTests/fast/block/layer-not-removed-from-parent-crash.html )
• Source/WebCore/ChangeLog (modified) (2 diffs)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)

branches/safari-536.28-branch/LayoutTests/ChangeLog

@@ +1 @@
+2012-11-02  Lucas Forschler  <lforschler@apple.com>
+
+        Merge r124564
+
+    2012-08-02  Abhishek Arya  <inferno@chromium.org>
+
+            Crash due to layer not removed from parent for anonymous block.
+            https://bugs.webkit.org/show_bug.cgi?id=90800
+
+            Reviewed by Kent Tamura.
+
+            * fast/block/layer-not-removed-from-parent-crash-expected.txt: Added.
+            * fast/block/layer-not-removed-from-parent-crash.html: Added.
+
 2012-11-02  Lucas Forschler  <lforschler@apple.com>
 
@@ -10743 +10757 @@
 .
 .
+.

branches/safari-536.28-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2012-11-02  Lucas Forschler  <lforschler@apple.com>
+
+        Merge r124564
+
+    2012-08-02  Abhishek Arya  <inferno@chromium.org>
+
+            Crash due to layer not removed from parent for anonymous block.
+            https://bugs.webkit.org/show_bug.cgi?id=90800
+
+            Reviewed by Kent Tamura.
+
+            Reverse the order of setStyle and removeChildNode calls. This ensures that setting the style
+            properly removes its layer from the parent in RenderBoxModelObject::styleDidChange. Calling
+            removeChildNode before calling setStyle is problematic since the parent layer never gets
+            notified.
+
+            Test: fast/block/layer-not-removed-from-parent-crash.html
+
+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::removeChild):
+
 2012-11-02  Lucas Forschler  <lforschler@apple.com>
 
@@ -206027 +206048 @@
 .
 .
+.

branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp

@@ -1181 +1181 @@
             ASSERT(!inlineChildrenBlock->continuation());
             RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyleWithDisplay(style(), BLOCK);
+            inlineChildrenBlock->setStyle(newStyle);
             children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlock->hasLayer());
-            inlineChildrenBlock->setStyle(newStyle);
             
             // Now just put the inlineChildrenBlock inside the blockChildrenBlock.