Changeset 98763 in webkit

Timestamp:

Oct 28, 2011, 2:28:39 PM (15 years ago)

Author:

commit-queue@webkit.org

Message:

Crash when splitting inline flows with generated floats
​https://bugs.webkit.org/show_bug.cgi?id=70458

Patch by Ken Buchanan <​kenrb@chromium.org> on 2011-10-28
Reviewed by David Hyatt.

Source/WebCore:

When lineBoxes on a RenderBlock are being deleted, we now check the floating object list to
ensure references to them are being cleared.

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::deleteLineBoxTree): Remove references to lineBox when deleting them

LayoutTests:

Added test for crash condition when splitting inline flows on an object with generated floats.

• fast/css-generated-content/inline-splitting-with-after-float-crash.html: Added
• fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt: Added

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt (added)
• LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff, 1 prop)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-10-28  Ken Buchanan <kenrb@chromium.org>
+
+        Crash when splitting inline flows with generated floats
+        https://bugs.webkit.org/show_bug.cgi?id=70458
+
+        Reviewed by David Hyatt.
+
+        Added test for crash condition when splitting inline flows on an object with generated floats.
+
+        * fast/css-generated-content/inline-splitting-with-after-float-crash.html: Added
+        * fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt: Added
+
 2011-10-28  John Gregg  <johnnyg@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-10-28  Ken Buchanan <kenrb@chromium.org>
+
+        Crash when splitting inline flows with generated floats
+        https://bugs.webkit.org/show_bug.cgi?id=70458
+
+        Reviewed by David Hyatt.
+
+        When lineBoxes on a RenderBlock are being deleted, we now check the floating object list to
+        ensure references to them are being cleared.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree): Remove references to lineBox when deleting them
+
 2011-10-28  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -839 +839 @@
 void RenderBlock::deleteLineBoxTree()
 {
+    if (containsFloats()) {
+        // Clear references to originating lines, since the lines are being deleted
+        const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+        FloatingObjectSetIterator end = floatingObjectSet.end();
+        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+            ASSERT(!((*it)->m_originatingLine) || (*it)->m_originatingLine->renderer() == this);
+            (*it)->m_originatingLine = 0;
+        }
+    }
     m_lineBoxes.deleteLineBoxTree(renderArena());
 }