Changeset 32532 in webkit


Ignore:
Timestamp:
Apr 24, 2008 9:04:46 PM (16 years ago)
Author:
mitz@apple.com
Message:

WebCore:

Reviewed by Dave Hyatt.

Test: fast/dynamic/float-remove-above-line.html

  • rendering/bidi.cpp: (WebCore::RenderBlock::layoutInlineChildren): Avoid adding floats that do not intrude into the line to its floats vector. When such floats go away, they do not dirty the line (because they do not intersect with it) and having it keep them in its floats vector is what caused the crash.

LayoutTests:

Reviewed by Dave Hyatt.

  • fast/dynamic/float-remove-above-line-expected.txt: Added.
  • fast/dynamic/float-remove-above-line.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r32528 r32532  
     12008-04-24  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Dave Hyatt.
     4
     5        - test for https://bugs.webkit.org/show_bug.cgi?id=18722
     6          <rdar://problem/5888360> REGRESSION (3.1 -> TOT): Webkit Nightly Build crashes when visiting i has a hotdog
     7
     8        * fast/dynamic/float-remove-above-line-expected.txt: Added.
     9        * fast/dynamic/float-remove-above-line.html: Added.
     10
    1112008-04-24  Cameron McCormack  <cam@mcc.id.au>
    212
  • trunk/WebCore/ChangeLog

    r32531 r32532  
     12008-04-24  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Dave Hyatt.
     4
     5        - fix https://bugs.webkit.org/show_bug.cgi?id=18722
     6          <rdar://problem/5888360> REGRESSION (3.1 -> TOT): Webkit Nightly Build crashes when visiting i has a hotdog
     7
     8        Test: fast/dynamic/float-remove-above-line.html
     9
     10        * rendering/bidi.cpp:
     11        (WebCore::RenderBlock::layoutInlineChildren): Avoid adding floats that
     12        do not intrude into the line to its floats vector. When such floats go
     13        away, they do not dirty the line (because they do not intersect with it)
     14        and having it keep them in its floats vector is what caused the crash.
     15
    1162008-04-24  Justin Garcia  <justin.garcia@apple.com>
    217
  • trunk/WebCore/rendering/bidi.cpp

    r32508 r32532  
    929929        bool endLineMatched = false;
    930930        bool checkForEndLineMatch = endLine;
     931        int lastHeight = m_height;
    931932
    932933        while (!end.atEnd()) {
     
    10591060                    m_floatingObjects->first();
    10601061                for (FloatingObject* f = m_floatingObjects->current(); f; f = m_floatingObjects->next()) {
    1061                     lastRootBox()->floats().append(f->m_renderer);
     1062                    if (f->m_bottom > lastHeight)
     1063                        lastRootBox()->floats().append(f->m_renderer);
    10621064                    ASSERT(f->m_renderer == floats[floatIndex].object);
    10631065                    // If a float's geometry has changed, give up on syncing with clean lines.
     
    10691071            }
    10701072
     1073            lastHeight = m_height;
    10711074            sNumMidpoints = 0;
    10721075            sCurrMidpoint = 0;
     
    11201123                } else
    11211124                    m_floatingObjects->first();
    1122                 for (FloatingObject* f = m_floatingObjects->current(); f; f = m_floatingObjects->next())
    1123                     lastRootBox()->floats().append(f->m_renderer);
     1125                for (FloatingObject* f = m_floatingObjects->current(); f; f = m_floatingObjects->next()) {
     1126                    if (f->m_bottom > lastHeight)
     1127                        lastRootBox()->floats().append(f->m_renderer);
     1128                }
    11241129                lastFloat = m_floatingObjects->last();
    11251130            }
Note: See TracChangeset for help on using the changeset viewer.