Changeset 94001 in webkit


Ignore:
Timestamp:
Aug 29, 2011, 12:19:52 PM (14 years ago)
Author:
inferno@chromium.org
Message:

Crash in InlineBox::deleteLine due to accessing removed
renderer.
​https://bugs.webkit.org/show_bug.cgi?id=66015

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/block/line-layout/inline-box-wrapper-crash.html

  • rendering/RenderBox.cpp:

(WebCore::RenderBox::positionLineBox): Make sure that the
previous inline box wrapper is destroyed properly, before
setting a new one.

LayoutTests:

  • fast/block/line-layout/inline-box-wrapper-crash-expected.txt: Added.
  • fast/block/line-layout/inline-box-wrapper-crash.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r93997 r94001  
     12011-08-29  Abhishek Arya  <inferno@chromium.org>
     2
     3        Crash in InlineBox::deleteLine due to accessing removed
     4        renderer.
     5        https://bugs.webkit.org/show_bug.cgi?id=66015
     6
     7        Reviewed by Simon Fraser.
     8
     9        * fast/block/line-layout/inline-box-wrapper-crash-expected.txt: Added.
     10        * fast/block/line-layout/inline-box-wrapper-crash.html: Added.
     11
    1122011-08-29  Chris Marrin  <cmarrin@apple.com>
    213

  • trunk/Source/WebCore/ChangeLog

    r93998 r94001  
     12011-08-29  Abhishek Arya  <inferno@chromium.org>
     2
     3        Crash in InlineBox::deleteLine due to accessing removed
     4        renderer.
     5        https://bugs.webkit.org/show_bug.cgi?id=66015
     6
     7        Reviewed by Simon Fraser.
     8
     9        Test: fast/block/line-layout/inline-box-wrapper-crash.html
     10
     11        * rendering/RenderBox.cpp:
     12        (WebCore::RenderBox::positionLineBox): Make sure that the
     13        previous inline box wrapper is destroyed properly, before
     14        setting a new one.
     15
    1162011-08-29  Alexey Proskuryakov  <ap@apple.com>
    217

  • trunk/Source/WebCore/rendering/RenderBox.cpp

    r93820 r94001  
    13781378    } else if (isReplaced()) {
    13791379        setLocation(roundedLayoutPoint(FloatPoint(box->x(), box->y())));
     1380        if (m_inlineBoxWrapper)
     1381            deleteLineBoxWrapper();
    13801382        m_inlineBoxWrapper = box;
    13811383    }
Note: See TracChangeset for help on using the changeset viewer.