Changeset 96955 in webkit

Timestamp:

Oct 7, 2011, 10:19:32 AM (14 years ago)

Author:

inferno@chromium.org

Message:

Merge 96632 - Source/WebCore: Hold refptr to identified previous sibling within findPlaceForCounter.

BUG=96902
Review URL: ​http://codereview.chromium.org/8206006

Location:

branches/chromium/874

Files:

• LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/css/counters/counter-after-style-crash-expected.txt )
• LayoutTests/fast/css/counters/counter-after-style-crash.html (copied) (copied from trunk/LayoutTests/fast/css/counters/counter-after-style-crash.html )
• Source/WebCore/rendering/RenderCounter.cpp (modified) (9 diffs)

branches/chromium/874/Source/WebCore/rendering/RenderCounter.cpp

@@ -304 +304 @@
     RenderObject* currentRenderer = previousInPreOrder(counterOwner);
     previousSibling = 0;
+    RefPtr<CounterNode> previousSiblingProtector = 0;
+
     while (currentRenderer) {
         CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
@@ -310 +312 @@
             if (currentCounter) {
                 // We have a suitable counter on the EndSearchRenderer.
-                if (previousSibling) { // But we already found another counter that we come after.
+                if (previousSiblingProtector) { // But we already found another counter that we come after.
                     if (currentCounter->actsAsReset()) {
                         // We found a reset counter that is on a renderer that is a sibling of ours or a parent.
@@ -327 +329 @@
                         // In these cases the identified previousSibling will be invalid as its parent is different from
                         // our identified parent.
-                        if (previousSibling->parent() != currentCounter)
-                            previousSibling = 0;
+                        if (previousSiblingProtector->parent() != currentCounter)
+                            previousSiblingProtector = 0;
+
+                        previousSibling = previousSiblingProtector.get();
                         return true;
                     }
@@ -335 +339 @@
                         // If the node we are placing is not reset or we have found a counter that is attached
                         // to an ancestor of the placed counter's owner renderer we know we are a sibling of that node.
-                        ASSERT(currentCounter->parent() == previousSibling->parent());
+                        ASSERT(currentCounter->parent() == previousSiblingProtector->parent());
                         parent = currentCounter->parent();
+                        previousSibling = previousSiblingProtector.get();
                         return true;
                     }
@@ -351 +356 @@
                         }
                         parent = currentCounter;
+                        previousSibling = previousSiblingProtector.get();
                         return true;
                     }
@@ -358 +364 @@
                         return true;
                     }
-                    previousSibling = currentCounter;
+                    previousSiblingProtector = currentCounter;
                 }
             }
@@ -371 +377 @@
             if (currentCounter) {
                 // We found a suitable counter.
-                if (previousSibling) {
+                if (previousSiblingProtector) {
                     // Since we had a suitable previous counter before, we should only consider this one as our 
                     // previousSibling if it is a reset counter and hence the current previousSibling is its child.
                     if (currentCounter->actsAsReset()) {
-                        previousSibling = currentCounter;
+                        previousSiblingProtector = currentCounter;
                         // We are no longer interested in previous siblings of the currentRenderer or their children
                         // as counters they may have attached cannot be the previous sibling of the counter we are placing.
@@ -382 +388 @@
                     }
                 } else
-                    previousSibling = currentCounter;
+                    previousSiblingProtector = currentCounter;
                 currentRenderer = previousSiblingOrParent(currentRenderer);
                 continue;
@@ -391 +397 @@
         // performance improvement would create more code duplication than is worthwhile in my oppinion and may further
         // impede the readability of this already complex algorithm.
-        if (previousSibling)
+        if (previousSiblingProtector)
             currentRenderer = previousSiblingOrParent(currentRenderer);
         else