Changeset 141982 in webkit

Timestamp:

Feb 6, 2013 3:32:16 AM (11 years ago)

Author:

commit-queue@webkit.org

Message:

[CSSRegions] Assertion failure in Node::detach (!renderer

renderer->inRenderFlowThread())

​https://bugs.webkit.org/show_bug.cgi?id=104517

Patch by Mihai Maerean <Mihai Maerean> on 2013-02-06
Reviewed by Julien Chaffraix.

Source/WebCore:

The RenderObject::inRenderFlowThread bit could have become disconnected from the fact that the RenderObject
has (or not) an enclosing RenderFlowThread.
The cause of this was that, when setting or removing the parent of a RenderObject, the inRenderFlowThread flags
wasn't being set/reset for the children too.
This is now fixed by calling the new setInRenderFlowThreadIncludingDescendants.

The ASSERT was hit for anonymous blocks when detaching the document.

Test: fast/regions/detaching-regions-with-anonymous-blocks.html

• rendering/RenderObject.cpp:

(WebCore::RenderObject::setInRenderFlowThreadRecursive):
(WebCore):

• rendering/RenderObject.h:

(WebCore::RenderObject::setParent):
(RenderObject):

LayoutTests:

The test adds an anonymous block in a region and detaches the body of document. The ASSERT is not hit anymore.

• fast/regions/detaching-regions-with-anonymous-blocks-expected.txt: Added.
• fast/regions/detaching-regions-with-anonymous-blocks.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks-expected.txt (added)
• LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderObject.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderObject.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-02-06  Mihai Maerean  <mmaerean@adobe.com>
+
+        [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())
+        https://bugs.webkit.org/show_bug.cgi?id=104517
+
+        Reviewed by Julien Chaffraix.
+
+        The test adds an anonymous block in a region and detaches the body of document. The ASSERT is not hit anymore.
+
+        * fast/regions/detaching-regions-with-anonymous-blocks-expected.txt: Added.
+        * fast/regions/detaching-regions-with-anonymous-blocks.html: Added.
+
 2013-02-06  Marja Hölttä  <marja@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-02-06  Mihai Maerean  <mmaerean@adobe.com>
+
+        [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())
+        https://bugs.webkit.org/show_bug.cgi?id=104517
+
+        Reviewed by Julien Chaffraix.
+
+        The RenderObject::inRenderFlowThread bit could have become disconnected from the fact that the RenderObject
+        has (or not) an enclosing RenderFlowThread.
+        The cause of this was that, when setting or removing the parent of a RenderObject, the inRenderFlowThread flags
+        wasn't being set/reset for the children too.
+        This is now fixed by calling the new setInRenderFlowThreadIncludingDescendants.
+
+        The ASSERT was hit for anonymous blocks when detaching the document.
+
+        Test: fast/regions/detaching-regions-with-anonymous-blocks.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setInRenderFlowThreadRecursive):
+        (WebCore):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setParent):
+        (RenderObject):
+
 2013-02-06  Marja Hölttä  <marja@chromium.org>
 

trunk/Source/WebCore/rendering/RenderObject.cpp

@@ -277 +277 @@
 {
     return node() && node()->renderer() == this && node()->hasTagName(marqueeTag);
+}
+
+void RenderObject::setInRenderFlowThreadIncludingDescendants(bool b)
+{
+    setInRenderFlowThread(b);
+
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        ASSERT(b != child->inRenderFlowThread());
+        child->setInRenderFlowThreadIncludingDescendants(b);
+    }
 }
 

trunk/Source/WebCore/rendering/RenderObject.h

@@ -271 +271 @@
     {
         m_parent = parent;
-        if (parent && parent->inRenderFlowThread())
-            setInRenderFlowThread(true);
+        if (parent && parent->inRenderFlowThread() && !inRenderFlowThread())
+            setInRenderFlowThreadIncludingDescendants(true);
         else if (!parent && inRenderFlowThread())
-            setInRenderFlowThread(false);
+            setInRenderFlowThreadIncludingDescendants(false);
     }
     //////////////////////////////////////////
@@ -434 +434 @@
     bool inRenderFlowThread() const { return m_bitfields.inRenderFlowThread(); }
     void setInRenderFlowThread(bool b = true) { m_bitfields.setInRenderFlowThread(b); }
+
+    void setInRenderFlowThreadIncludingDescendants(bool = true);
 
     virtual bool requiresForcedStyleRecalcPropagation() const { return false; }