Changeset 20188 in webkit
- Timestamp:
- Mar 14, 2007 10:25:04 AM (17 years ago)
- Location:
- trunk
- Files:
-
- 4 added
- 4 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r20186 r20188 1 2007-03-14 Mitz Pettel <mitz@webkit.org> 2 3 Reviewed by Hyatt, thumbs up by Darin. 4 5 - test for http://bugs.webkit.org/show_bug.cgi?id=12782 6 Reproducible crash in BidiContext::deref 7 8 * fast/dynamic/anonymous-block-orphaned-lines-expected.checksum: Added. 9 * fast/dynamic/anonymous-block-orphaned-lines-expected.png: Added. 10 * fast/dynamic/anonymous-block-orphaned-lines-expected.txt: Added. 11 * fast/dynamic/anonymous-block-orphaned-lines.html: Added. 12 1 13 2007-03-14 Antti Koivisto <antti@apple.com> 2 14 -
trunk/WebCore/ChangeLog
r20187 r20188 1 2007-03-14 Mitz Pettel <mitz@webkit.org> 2 3 Reviewed by Hyatt, thumbs up by Darin. 4 5 - fix http://bugs.webkit.org/show_bug.cgi?id=12782 6 Reproducible crash in BidiContext::deref 7 8 Test: fast/dynamic/anonymous-block-orphaned-lines.html 9 10 * rendering/InlineBox.cpp: 11 (WebCore::InlineBox::root): Added an assertion that we return a root inline box. 12 * rendering/RenderBlock.cpp: 13 (WebCore::RenderBlock::removeChild): Added code to adopt the line boxes of 14 anonymous blocks being destroyed instead of leaving them orphaned, which 15 is what caused this crash. The boxes will be deleted on the next layout, but 16 this ensures consistency in the mean time. 17 1 18 2007-03-14 Lars Knoll <lars@trolltech.com> 2 19 -
trunk/WebCore/rendering/InlineBox.cpp
r18697 r20188 174 174 if (m_parent) 175 175 return m_parent->root(); 176 ASSERT(isRootInlineBox()); 176 177 return static_cast<RootInlineBox*>(this); 177 178 } -
trunk/WebCore/rendering/RenderBlock.cpp
r20177 r20188 344 344 no->setNeedsLayoutAndMinMaxRecalc(); 345 345 } 346 347 // Do the same with line boxes. 348 RenderBlock* prevBlock = static_cast<RenderBlock*>(prev); 349 RenderBlock* nextBlock = static_cast<RenderBlock*>(next); 350 if (RootInlineBox* box = nextBlock->firstRootBox()) { 351 if (prevBlock->lastRootBox()) { 352 prevBlock->lastRootBox()->setNextLineBox(box); 353 box->setPreviousLineBox(prevBlock->lastRootBox()); 354 } else 355 prevBlock->m_firstLineBox = box; 356 357 while (box) { 358 prevBlock->m_lastLineBox = box; 359 box->m_object = prevBlock; 360 box = box->nextRootBox(); 361 } 362 nextBlock->m_firstLineBox = 0; 363 nextBlock->m_lastLineBox = 0; 364 } 365 346 366 // Nuke the now-empty block. 347 367 next->destroy(); … … 356 376 // box. 357 377 setNeedsLayoutAndMinMaxRecalc(); 358 Render Object* anonBlock = removeChildNode(child);378 RenderBlock* anonBlock = static_cast<RenderBlock*>(removeChildNode(child)); 359 379 m_childrenInline = true; 360 380 RenderObject* o = anonBlock->firstChild(); … … 365 385 no->setNeedsLayoutAndMinMaxRecalc(); 366 386 } 387 388 // Take over the anonymous child's line boxes. 389 RootInlineBox* box = anonBlock->firstRootBox(); 390 m_firstLineBox = box; 391 while (box) { 392 m_lastLineBox = box; 393 box->m_object = this; 394 box = box->nextRootBox(); 395 } 396 anonBlock->m_firstLineBox = 0; 397 anonBlock->m_lastLineBox = 0; 367 398 368 399 // Nuke the now-empty block.
Note: See TracChangeset
for help on using the changeset viewer.