Changeset 20188 in webkit


Ignore:
Timestamp:
Mar 14, 2007 10:25:04 AM (17 years ago)
Author:
weinig
Message:

LayoutTests:

Reviewed by Hyatt, thumbs up by Darin.

  • fast/dynamic/anonymous-block-orphaned-lines-expected.checksum: Added.
  • fast/dynamic/anonymous-block-orphaned-lines-expected.png: Added.
  • fast/dynamic/anonymous-block-orphaned-lines-expected.txt: Added.
  • fast/dynamic/anonymous-block-orphaned-lines.html: Added.

WebCore:

Reviewed by Hyatt, thumbs up by Darin.

Test: fast/dynamic/anonymous-block-orphaned-lines.html

  • rendering/InlineBox.cpp: (WebCore::InlineBox::root): Added an assertion that we return a root inline box.
  • rendering/RenderBlock.cpp: (WebCore::RenderBlock::removeChild): Added code to adopt the line boxes of anonymous blocks being destroyed instead of leaving them orphaned, which is what caused this crash. The boxes will be deleted on the next layout, but this ensures consistency in the mean time.
Location:
trunk
Files:
4 added
4 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r20186 r20188  
     12007-03-14  Mitz Pettel  <mitz@webkit.org>
     2
     3        Reviewed by Hyatt, thumbs up by Darin.
     4
     5        - test for http://bugs.webkit.org/show_bug.cgi?id=12782
     6          Reproducible crash in BidiContext::deref
     7
     8        * fast/dynamic/anonymous-block-orphaned-lines-expected.checksum: Added.
     9        * fast/dynamic/anonymous-block-orphaned-lines-expected.png: Added.
     10        * fast/dynamic/anonymous-block-orphaned-lines-expected.txt: Added.
     11        * fast/dynamic/anonymous-block-orphaned-lines.html: Added.
     12
    1132007-03-14  Antti Koivisto  <antti@apple.com>
    214
  • trunk/WebCore/ChangeLog

    r20187 r20188  
     12007-03-14  Mitz Pettel  <mitz@webkit.org>
     2
     3        Reviewed by Hyatt, thumbs up by Darin.
     4
     5        - fix http://bugs.webkit.org/show_bug.cgi?id=12782
     6          Reproducible crash in BidiContext::deref
     7
     8        Test: fast/dynamic/anonymous-block-orphaned-lines.html
     9
     10        * rendering/InlineBox.cpp:
     11        (WebCore::InlineBox::root): Added an assertion that we return a root inline box.
     12        * rendering/RenderBlock.cpp:
     13        (WebCore::RenderBlock::removeChild): Added code to adopt the line boxes of
     14        anonymous blocks being destroyed instead of leaving them orphaned, which
     15        is what caused this crash. The boxes will be deleted on the next layout, but
     16        this ensures consistency in the mean time.
     17
    1182007-03-14  Lars Knoll <lars@trolltech.com>
    219
  • trunk/WebCore/rendering/InlineBox.cpp

    r18697 r20188  
    174174    if (m_parent)
    175175        return m_parent->root();
     176    ASSERT(isRootInlineBox());
    176177    return static_cast<RootInlineBox*>(this);
    177178}
  • trunk/WebCore/rendering/RenderBlock.cpp

    r20177 r20188  
    344344            no->setNeedsLayoutAndMinMaxRecalc();
    345345        }
     346       
     347        // Do the same with line boxes.
     348        RenderBlock* prevBlock = static_cast<RenderBlock*>(prev);
     349        RenderBlock* nextBlock = static_cast<RenderBlock*>(next);
     350        if (RootInlineBox* box = nextBlock->firstRootBox()) {
     351            if (prevBlock->lastRootBox()) {
     352                prevBlock->lastRootBox()->setNextLineBox(box);
     353                box->setPreviousLineBox(prevBlock->lastRootBox());
     354            } else
     355                prevBlock->m_firstLineBox = box;
     356
     357            while (box) {
     358                prevBlock->m_lastLineBox = box;
     359                box->m_object = prevBlock;
     360                box = box->nextRootBox();
     361            }
     362            nextBlock->m_firstLineBox = 0;
     363            nextBlock->m_lastLineBox = 0;
     364        }
     365       
    346366        // Nuke the now-empty block.
    347367        next->destroy();
     
    356376        // box.
    357377        setNeedsLayoutAndMinMaxRecalc();
    358         RenderObject* anonBlock = removeChildNode(child);
     378        RenderBlock* anonBlock = static_cast<RenderBlock*>(removeChildNode(child));
    359379        m_childrenInline = true;
    360380        RenderObject* o = anonBlock->firstChild();
     
    365385            no->setNeedsLayoutAndMinMaxRecalc();
    366386        }
     387
     388        // Take over the anonymous child's line boxes.
     389        RootInlineBox* box = anonBlock->firstRootBox();
     390        m_firstLineBox = box;
     391        while (box) {
     392            m_lastLineBox = box;
     393            box->m_object = this;
     394            box = box->nextRootBox();
     395        }
     396        anonBlock->m_firstLineBox = 0;
     397        anonBlock->m_lastLineBox = 0;
    367398
    368399        // Nuke the now-empty block.
Note: See TracChangeset for help on using the changeset viewer.