Changeset 195146 in webkit

Timestamp:

Jan 15, 2016 1:49:33 PM (8 years ago)

Author:

Alan Bujtas

Message:

ASSERTION FAILED: canHaveChildren()

canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal

​https://bugs.webkit.org/show_bug.cgi?id=123331

Reviewed by Darin Adler.

Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).

Source/WebCore:

Test: fast/regions/input-box-with-region-assert.html

• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::willBeDestroyed):
(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
(WebCore::RenderBlockFlow::setRenderNamedFlowFragment):

LayoutTests:

• fast/regions/input-box-with-region-assert-expected.txt: Added.
• fast/regions/input-box-with-region-assert.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/regions/input-box-with-region-assert-expected.txt (added)
• LayoutTests/fast/regions/input-box-with-region-assert.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockFlow.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-01-15  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
+        https://bugs.webkit.org/show_bug.cgi?id=123331
+
+        Reviewed by Darin Adler.
+
+        Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
+        could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
+
+        * fast/regions/input-box-with-region-assert-expected.txt: Added.
+        * fast/regions/input-box-with-region-assert.html: Added.
+
 2016-01-15  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-01-15  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
+        https://bugs.webkit.org/show_bug.cgi?id=123331
+
+        Reviewed by Darin Adler.
+
+        Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
+        could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
+
+        Test: fast/regions/input-box-with-region-assert.html
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::willBeDestroyed):
+        (WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
+        (WebCore::RenderBlockFlow::setRenderNamedFlowFragment):
+
 2016-01-15  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -145 +145 @@
 {
     if (renderNamedFlowFragment())
-        setRenderNamedFlowFragment(0);
+        setRenderNamedFlowFragment(nullptr);
 
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
@@ -3152 +3152 @@
         RenderNamedFlowFragment* flowFragment = new RenderNamedFlowFragment(document(), RenderNamedFlowFragment::createStyle(style()));
         flowFragment->initializeStyle();
+        addChild(flowFragment);
         setRenderNamedFlowFragment(flowFragment);
-        addChild(renderNamedFlowFragment());
     }
 }
@@ -3199 +3199 @@
 {
     RenderBlockFlowRareData& rareData = ensureRareBlockFlowData();
-    if (rareData.m_renderNamedFlowFragment)
-        rareData.m_renderNamedFlowFragment->destroy();
+    if (auto* flowFragmentOnFlow = std::exchange(rareData.m_renderNamedFlowFragment, nullptr))
+        flowFragmentOnFlow->destroy();
     rareData.m_renderNamedFlowFragment = flowFragment;
 }