Changeset 108547 in webkit


Ignore:
Timestamp:
Feb 22, 2012 1:33:33 PM (12 years ago)
Author:
inferno@chromium.org
Message:

Source/WebCore: Crash due to accessing removed parent lineboxes when clearing view selection.
​https://bugs.webkit.org/show_bug.cgi?id=79264

Reviewed by Eric Seidel.

When our block needed a full layout, we were deleting our own lineboxes
and letting descendant children (at any level in hierarchy and not just
immediate children) clear their own lineboxes as we keep laying them out.
This was problematic because those descendant children lineboxes were
pointing to removed parent lineboxes in the meantime. An example scenario
where this would go wrong is first-letter object removal, which can cause
clearing view selection, leading to accessing parent lineboxes. The patch
modifies clearing the entire linebox tree upfront. It shouldn't introduce
performance issues since it will eventually happen as we are laying out
those children.

Test: fast/css-generated-content/first-letter-textbox-parent-crash.html

  • rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlock::layoutInlineChildren):

LayoutTests: Crash due to accessing removed parent lineboxes when clearing view selection.
​https://bugs.webkit.org/show_bug.cgi?id=79264

Reviewed by Eric Seidel.

  • fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt: Added.
  • fast/css-generated-content/first-letter-textbox-parent-crash.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r108543 r108547  
     12012-02-22  Abhishek Arya  <inferno@chromium.org>
     2
     3        Crash due to accessing removed parent lineboxes when clearing view selection.
     4        https://bugs.webkit.org/show_bug.cgi?id=79264
     5 
     6        Reviewed by Eric Seidel.
     7
     8        * fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt: Added.
     9        * fast/css-generated-content/first-letter-textbox-parent-crash.html: Added.
     10
    1112012-02-22  Abhishek Arya  <inferno@chromium.org>
    212

  • trunk/Source/WebCore/ChangeLog

    r108543 r108547  
     12012-02-22  Abhishek Arya  <inferno@chromium.org>
     2
     3        Crash due to accessing removed parent lineboxes when clearing view selection.
     4        https://bugs.webkit.org/show_bug.cgi?id=79264
     5
     6        Reviewed by Eric Seidel.
     7
     8        When our block needed a full layout, we were deleting our own lineboxes
     9        and letting descendant children (at any level in hierarchy and not just
     10        immediate children) clear their own lineboxes as we keep laying them out.
     11        This was problematic because those descendant children lineboxes were
     12        pointing to removed parent lineboxes in the meantime. An example scenario
     13        where this would go wrong is first-letter object removal, which can cause
     14        clearing view selection, leading to accessing parent lineboxes. The patch
     15        modifies clearing the entire linebox tree upfront. It shouldn't introduce
     16        performance issues since it will eventually happen as we are laying out
     17        those children.
     18 
     19        Test: fast/css-generated-content/first-letter-textbox-parent-crash.html
     20
     21        * rendering/RenderBlockLineLayout.cpp:
     22        (WebCore::RenderBlock::layoutInlineChildren):
     23
    1242012-02-22  Abhishek Arya  <inferno@chromium.org>
    225

  • trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

    r108117 r108547  
    14631463
    14641464    if (isFullLayout)
    1465         lineBoxes()->deleteLineBoxes(renderArena());
     1465        deleteLineBoxTree();
    14661466
    14671467    // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
Note: See TracChangeset for help on using the changeset viewer.