Changeset 167718 in webkit

Timestamp:

Apr 23, 2014 11:55:43 AM (10 years ago)

Author:

hyatt@apple.com

Message:

[New Multicolumn] Crasher when clearing out a flow thread in multicolumn layout.
​https://bugs.webkit.org/show_bug.cgi?id=132069

Reviewed by Dean Jackson.

Source/WebCore:
This is imported from a patch Morten did for Blink, but I had to change it a fair
bit. deleteLines() is used to handle simple line box layout instead of just calling
deleteLineBoxTree.

I also had to disable the layout state to stop asserts on repaint when the children
get moved. Not sure why Blink didn't hit this, but it's simple enough to add a
LayoutStateDisabler to stop the assert.

Added fast/multicol/inline-children-crash.html

• rendering/RenderMultiColumnFlowThread.cpp:

(WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):

LayoutTests:

• fast/multicol/inline-children-crash-expected.txt: Added.
• fast/multicol/inline-children-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/multicol/inline-children-crash-expected.txt (added)
• LayoutTests/fast/multicol/inline-children-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-04-23  David Hyatt  <hyatt@apple.com>
+
+        [New Multicolumn] Crasher when clearing out a flow thread in multicolumn layout.
+        https://bugs.webkit.org/show_bug.cgi?id=132069
+
+        Reviewed by Dean Jackson.
+
+        * fast/multicol/inline-children-crash-expected.txt: Added.
+        * fast/multicol/inline-children-crash.html: Added.
+
 2014-04-23  Morten Stenshorne  <mstensho@opera.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-04-23  David Hyatt  <hyatt@apple.com>
+
+        [New Multicolumn] Crasher when clearing out a flow thread in multicolumn layout.
+        https://bugs.webkit.org/show_bug.cgi?id=132069
+
+        Reviewed by Dean Jackson.
+
+        This is imported from a patch Morten did for Blink, but I had to change it a fair
+        bit. deleteLines() is used to handle simple line box layout instead of just calling
+        deleteLineBoxTree.
+        
+        I also had to disable the layout state to stop asserts on repaint when the children
+        get moved. Not sure why Blink didn't hit this, but it's simple enough to add a
+        LayoutStateDisabler to stop the assert.
+
+        Added fast/multicol/inline-children-crash.html
+
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):
+
 2014-04-23  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp

@@ -31 +31 @@
 #include "RenderMultiColumnSet.h"
 #include "RenderMultiColumnSpannerPlaceholder.h"
+#include "RenderView.h"
 #include "TransformState.h"
 
@@ -162 +163 @@
     RenderBlockFlow* multicolContainer = multiColumnBlockFlow();
     m_beingEvacuated = true;
+    
+    // Delete the line box tree.
+    deleteLines();
+    
+    LayoutStateDisabler layoutStateDisabler(&view());
 
     // First promote all children of the flow thread. Before we move them to the flow thread's
@@ -184 +190 @@
     while (RenderMultiColumnSet* columnSet = firstMultiColumnSet())
         columnSet->destroy();
-
+    
     destroy();
 }