Changeset 179706 in webkit

Timestamp:

Feb 5, 2015, 1:55:45 PM (12 years ago)

Author:

mjs@apple.com

Message:

Crash due to failing to dirty a removed text node's line box
​https://bugs.webkit.org/show_bug.cgi?id=136544

Reviewed by David Hyatt.
Source/WebCore:

Test: fast/text/remove-text-node-linebox-not-dirty-crash.html

• rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Make the check for dirtying the next
line box a bit more inclusive to avoid a case of a line box for a destroyed render object not
being dirtied. In particular, when the text node's parent has no line boxes but contains BRs.

LayoutTests:

• fast/text/remove-text-node-linebox-not-dirty-crash-expected.txt: Added.
• fast/text/remove-text-node-linebox-not-dirty-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/text/remove-text-node-linebox-not-dirty-crash-expected.txt (added)
• LayoutTests/fast/text/remove-text-node-linebox-not-dirty-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderLineBoxList.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-02-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Crash due to failing to dirty a removed text node's line box
+        https://bugs.webkit.org/show_bug.cgi?id=136544
+
+        Reviewed by David Hyatt.
+
+        * fast/text/remove-text-node-linebox-not-dirty-crash-expected.txt: Added.
+        * fast/text/remove-text-node-linebox-not-dirty-crash.html: Added.
+
 2015-02-05  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-02-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Crash due to failing to dirty a removed text node's line box
+        https://bugs.webkit.org/show_bug.cgi?id=136544
+
+        Reviewed by David Hyatt.
+        
+        Test: fast/text/remove-text-node-linebox-not-dirty-crash.html
+
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Make the check for dirtying the next
+        line box a bit more inclusive to avoid a case of a line box for a destroyed render object not
+        being dirtied. In particular, when the text node's parent has no line boxes but contains BRs.
+
 2015-02-05  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/rendering/RenderLineBoxList.cpp

@@ -397 +397 @@
         // one as |box|. If we hit that situation here, dirty the |box| actually containing the child too. 
         bool insertedAfterLeadingSpace = box->lineBreakObj() == child.previousSibling();
-        if (adjacentBox && (adjacentBox->lineBreakObj() == &child || child.isBR() || (current && current->isBR())
+        if (adjacentBox && (adjacentBox->lineBreakObj()->isDescendantOf(&child) || child.isBR() || (current && current->isBR())
             || insertedAfterLeadingSpace || isIsolated(container.style().unicodeBidi())))
             adjacentBox->markDirty();