Changeset 179877 in webkit

Timestamp:

Feb 10, 2015, 12:27:40 PM (12 years ago)

Author:

Alan Bujtas

Message:

REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
​https://bugs.webkit.org/show_bug.cgi?id=133462

Reviewed by David Hyatt.

RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
we detach the inline tree first and destroy them after. The detached root boxes can't access
the flowthread containing block and we end up with dangling pointers in this map.
Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.

Source/WebCore:

Test: fast/multicol/newmulticol/crash-when-switching-to-floating.html

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::collapseAnonymousBoxChild):

LayoutTests:

• fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt: Added.
• fast/multicol/newmulticol/crash-when-switching-to-floating.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt (added)
• LayoutTests/fast/multicol/newmulticol/crash-when-switching-to-floating.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-02-07  Zalan Bujtas  <zalan@apple.com>
+
+        REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
+        https://bugs.webkit.org/show_bug.cgi?id=133462
+
+        Reviewed by David Hyatt.
+
+        RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
+        Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
+        we detach the inline tree first and destroy them after. The detached root boxes can't access
+        the flowthread containing block and we end up with dangling pointers in this map.
+        Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.
+
+        * fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt: Added.
+        * fast/multicol/newmulticol/crash-when-switching-to-floating.html: Added.
+
 2015-02-10  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-02-07  Zalan Bujtas  <zalan@apple.com>
+
+        REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
+        https://bugs.webkit.org/show_bug.cgi?id=133462
+
+        Reviewed by David Hyatt.
+
+        RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
+        Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
+        we detach the inline tree first and destroy them after. The detached root boxes can't access
+        the flowthread containing block and we end up with dangling pointers in this map.
+        Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.
+
+        Test: fast/multicol/newmulticol/crash-when-switching-to-floating.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseAnonymousBoxChild):
+
 2015-02-10  Julien Isorce  <j.isorce@samsung.com>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -673 +673 @@
     RenderObject* nextSibling = child->nextSibling();
 
-    RenderFlowThread* childFlowThread = child->flowThreadContainingBlock();
-    if (is<RenderNamedFlowThread>(childFlowThread))
-        downcast<RenderNamedFlowThread>(*childFlowThread).removeFlowChildInfo(child);
+    if (auto* childFlowThread = child->flowThreadContainingBlock())
+        childFlowThread->removeFlowChildInfo(child);
 
     parent.removeChildInternal(*child, child->hasLayer() ? NotifyChildren : DontNotifyChildren);