Changeset 28299 in webkit


Ignore:
Timestamp:
Dec 1, 2007, 8:33:40 AM (17 years ago)
Author:
mitz@apple.com
Message:

WebCore:

Reviewed by Darin Adler.

  • fix <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout)

Test: fast/dynamic/subtree-common-root.html

  • page/FrameView.cpp: (WebCore::FrameView::layoutRoot): Added a parameter to let this method return the layout root for a pending layout as well. (WebCore::FrameView::scheduleRelayoutOfSubtree): Pass the new root to markContainingBlocksForLayout(). Otherwise, markContainingBlocksForLayout() could mark past the new root, if it had previously been marked as having a normal child needing layout and then was reached via a positioned child.
  • page/FrameView.h:
  • rendering/RenderBox.cpp: (WebCore::RenderBox::calcWidth):
  • rendering/RenderObject.cpp: (WebCore::RenderObject::~RenderObject): Fixed the ASSERT so that it would really catch deletion of the layout root. (WebCore::RenderObject::markContainingBlocksForLayout): Added the newRoot parameter, which tells this method where to stop marking.
  • rendering/RenderObject.h:

LayoutTests:

Reviewed by Darin Adler.

  • test for <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout)
  • fast/dynamic/subtree-common-root-expected.txt: Added.
  • fast/dynamic/subtree-common-root.html: Added.
Location:
trunk
Files:
2 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r28260 r28299  
     12007-12-01  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        - test for <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout)
     6
     7        * fast/dynamic/subtree-common-root-expected.txt: Added.
     8        * fast/dynamic/subtree-common-root.html: Added.
     9
    1102007-11-30  Eric Seidel  <eric@webkit.org>
    211

  • trunk/WebCore/ChangeLog

    r28298 r28299  
     12007-12-01  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        - fix <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout)
     6
     7        Test: fast/dynamic/subtree-common-root.html
     8
     9        * page/FrameView.cpp:
     10        (WebCore::FrameView::layoutRoot): Added a parameter to let this method
     11        return the layout root for a pending layout as well.
     12        (WebCore::FrameView::scheduleRelayoutOfSubtree): Pass the new root
     13        to markContainingBlocksForLayout(). Otherwise,
     14        markContainingBlocksForLayout() could mark past the new root, if it had
     15        previously been marked as having a normal child needing layout and then
     16        was reached via a positioned child.
     17        * page/FrameView.h:
     18        * rendering/RenderBox.cpp:
     19        (WebCore::RenderBox::calcWidth):
     20        * rendering/RenderObject.cpp:
     21        (WebCore::RenderObject::~RenderObject): Fixed the ASSERT so that
     22        it would really catch deletion of the layout root.
     23        (WebCore::RenderObject::markContainingBlocksForLayout): Added the
     24        newRoot parameter, which tells this method where to stop marking.
     25        * rendering/RenderObject.h:
     26
    1272007-12-01  Dan Bernstein  <mitz@apple.com>
    228

  • trunk/WebCore/page/FrameView.cpp

    r27952 r28299  
    285285}
    286286
    287 RenderObject* FrameView::layoutRoot() const
    288 {
    289     return layoutPending() ? 0 : d->layoutRoot;
     287RenderObject* FrameView::layoutRoot(bool onlyDuringLayout) const
     288{
     289    return onlyDuringLayout && layoutPending() ? 0 : d->layoutRoot;
    290290}
    291291
    … …  
    738738            if (isObjectAncestorContainerOf(d->layoutRoot, o)) {
    739739                // Keep the current root
    740                 o->markContainingBlocksForLayout(false);
     740                o->markContainingBlocksForLayout(false, d->layoutRoot);
    741741            } else if (d->layoutRoot && isObjectAncestorContainerOf(o, d->layoutRoot)) {
    742742                // Re-root at o
    743                 d->layoutRoot->markContainingBlocksForLayout(false);
     743                d->layoutRoot->markContainingBlocksForLayout(false, o);
    744744                d->layoutRoot = o;
    745745            } else {

  • trunk/WebCore/page/FrameView.h

    r27952 r28299  
    7777    bool layoutPending() const;
    7878
    79     RenderObject* layoutRoot() const;
     79    RenderObject* layoutRoot(bool onlyDuringLayout = false) const;
    8080    int layoutCount() const;
    8181

  • trunk/WebCore/rendering/RenderBox.cpp

    r28226 r28299  
    10821082
    10831083    // If layout is limited to a subtree, the subtree root's width does not change.
    1084     if (node() && view()->frameView() && view()->frameView()->layoutRoot() == this)
     1084    if (node() && view()->frameView() && view()->frameView()->layoutRoot(true) == this)
    10851085        return;
    10861086

  • trunk/WebCore/rendering/RenderObject.cpp

    r28084 r28299  
    202202RenderObject::~RenderObject()
    203203{
    204     ASSERT(!node() || !document()->frame()->view() || document()->frame()->view()->layoutRoot() != this);
     204    ASSERT(!node() || documentBeingDestroyed() || !document()->frame()->view() || document()->frame()->view()->layoutRoot() != this);
    205205#ifndef NDEBUG
    206206    --RenderObjectCounter::count;
    … …  
    719719}
    720720   
    721 void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout)
    722 {
     721void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderObject* newRoot)
     722{
     723    ASSERT(!scheduleRelayout || !newRoot);
     724
    723725    RenderObject* o = container();
    724726    RenderObject* last = this;
    … …  
    736738            o->m_normalChildNeedsLayout = true;
    737739        }
     740
     741        if (o == newRoot)
     742            return;
    738743
    739744        last = o;

  • trunk/WebCore/rendering/RenderObject.h

    r28127 r28299  
    378378
    379379    virtual void markAllDescendantsWithFloatsForLayout(RenderObject* floatToRemove = 0);
    380     void markContainingBlocksForLayout(bool scheduleRelayout = true);
     380    void markContainingBlocksForLayout(bool scheduleRelayout = true, RenderObject* newRoot = 0);
    381381    void setNeedsLayout(bool b, bool markParents = true);
    382382    void setChildNeedsLayout(bool b, bool markParents = true);
Note: See TracChangeset for help on using the changeset viewer.