Changeset 101733 in webkit

Timestamp:

Dec 1, 2011 6:39:14 PM (12 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION(r101268): Intermittent assertion failure in fast/block/child-not-removed-from-parent-lineboxes-crash.html
​https://bugs.webkit.org/show_bug.cgi?id=73250

Reviewed by Darin Adler.

Reset the position when exiting early in layoutRunsAndFloatsInRange.

No new tests because we don't have a reliable reproduction for this failure.
However, the failure is caught by the existing fast/block/child-not-removed-from-parent-lineboxes-crash.html
intermittently with about 30% probability.

• rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlock::layoutRunsAndFloatsInRange):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBlockLineLayout.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-12-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r101268): Intermittent assertion failure in fast/block/child-not-removed-from-parent-lineboxes-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=73250
+
+        Reviewed by Darin Adler.
+
+        Reset the position when exiting early in layoutRunsAndFloatsInRange.
+
+        No new tests because we don't have a reliable reproduction for this failure.
+        However, the failure is caught by the existing fast/block/child-not-removed-from-parent-lineboxes-crash.html
+        intermittently with about 30% probability.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
+
 2011-12-01  Shinya Kawanaka  <shinyak@google.com>
 

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -1209 +1209 @@
         if (checkForEndLineMatch) {
             layoutState.setEndLineMatched(matchedEndLine(layoutState, resolver, cleanLineStart, cleanLineBidiStatus));
-            if (layoutState.endLineMatched())
+            if (layoutState.endLineMatched()) {
+                resolver.setPosition(InlineIterator(resolver.position().root(), 0, 0), 0);
                 break;
+            }
         }
 
@@ -1227 +1229 @@
             resolver.markCurrentRunEmpty(); // FIXME: This can probably be replaced by an ASSERT (or just removed).
             layoutState.setCheckForFloatsFromLastLine(true);
+            resolver.setPosition(InlineIterator(resolver.position().root(), 0, 0), 0);
             break;
         }