Changeset 124580 in webkit

Timestamp:

Aug 3, 2012 1:15:35 AM (12 years ago)

Author:

inferno@chromium.org

Message:

Regression(r124564): Wrong inlineChildrenBlock->hasLayer() computed in RenderBlock::removeChild.
​https://bugs.webkit.org/show_bug.cgi?id=90800

Reviewed by Eric Seidel.

r124564 reversed the sequence of setStyle and removeChildNode calls, but failed to cache the value
of inlineChildrenBlock->hasLayer(). So, it will be null when the layer is removed from parent in setStyle.
Fixed by the caching the bool value.

Covered by existing test fast/block/layer-not-removed-from-parent-crash.html.

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::removeChild):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBlock.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-08-03  Abhishek Arya  <inferno@chromium.org>
+
+        Regression(r124564): Wrong inlineChildrenBlock->hasLayer() computed in RenderBlock::removeChild.
+        https://bugs.webkit.org/show_bug.cgi?id=90800
+
+        Reviewed by Eric Seidel.
+
+        r124564 reversed the sequence of setStyle and removeChildNode calls, but failed to cache the value
+        of inlineChildrenBlock->hasLayer(). So, it will be null when the layer is removed from parent in setStyle.
+        Fixed by the caching the bool value. 
+
+        Covered by existing test fast/block/layer-not-removed-from-parent-crash.html.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
 2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -1170 +1170 @@
             ASSERT(!inlineChildrenBlock->continuation());
             RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyleWithDisplay(style(), BLOCK);
+            // Cache this value as it might get changed in setStyle() call.
+            bool inlineChildrenBlockHasLayer = inlineChildrenBlock->hasLayer();
             inlineChildrenBlock->setStyle(newStyle);
-            children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlock->hasLayer());
+            children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlockHasLayer);
             
             // Now just put the inlineChildrenBlock inside the blockChildrenBlock.
             blockChildrenBlock->children()->insertChildNode(blockChildrenBlock, inlineChildrenBlock, prev == inlineChildrenBlock ? blockChildrenBlock->firstChild() : 0,
-                                                            inlineChildrenBlock->hasLayer() || blockChildrenBlock->hasLayer());
+                                                            inlineChildrenBlockHasLayer || blockChildrenBlock->hasLayer());
             next->setNeedsLayoutAndPrefWidthsRecalc();