Changeset 207683 in webkit

Timestamp:

Oct 21, 2016, 10:39:17 AM (10 years ago)

Author:

Alan Bujtas

Message:

Do not mutate the render tree while collecting selection repaint rects.
​https://bugs.webkit.org/show_bug.cgi?id=163800
<rdar://problem/28806886>

Reviewed by David Hyatt.

Source/WebCore:

RenderListItem not only mutates the tree while in layout but it also uses
the old descendant context to find the insertion point.
This patch strictly ensures that we only do it while in layout and never
in other cases such as collecting repaint rects.
This gets redundant when webkit.org/b/163789 is fixed.

Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html

• rendering/RenderListItem.cpp:

(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):

LayoutTests:

• fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt: Added.
• fast/lists/crash-when-list-marker-is-moved-during-selection.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt (added)
• LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderListItem.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-10-21  Zalan Bujtas  <zalan@apple.com>
+
+        Do not mutate the render tree while collecting selection repaint rects.
+        https://bugs.webkit.org/show_bug.cgi?id=163800
+        <rdar://problem/28806886>
+
+        Reviewed by David Hyatt.
+
+        * fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt: Added.
+        * fast/lists/crash-when-list-marker-is-moved-during-selection.html: Added.
+
 2016-10-21  Miguel Gomez  <magomez@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-21  Zalan Bujtas  <zalan@apple.com>
+
+        Do not mutate the render tree while collecting selection repaint rects.
+        https://bugs.webkit.org/show_bug.cgi?id=163800
+        <rdar://problem/28806886>
+
+        Reviewed by David Hyatt.
+
+        RenderListItem not only mutates the tree while in layout but it also uses
+        the old descendant context to find the insertion point.
+        This patch strictly ensures that we only do it while in layout and never
+        in other cases such as collecting repaint rects.
+        This gets redundant when webkit.org/b/163789 is fixed.
+
+        Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
+
 2016-10-21  Dave Hyatt  <hyatt@apple.com>
 

trunk/Source/WebCore/rendering/RenderListItem.cpp

@@ -267 +267 @@
     // Sanity check the location of our marker.
     if (!m_marker)
+        return;
+
+    // FIXME: Do not even try reposition the marker when we are not in layout
+    // until after we fixed webkit.org/b/163789.
+    if (!view().frameView().isInRenderTreeLayout())
         return;