Changeset 21059 in webkit

Timestamp:

Apr 23, 2007 6:27:57 PM (17 years ago)

Author:

hyatt

Message:

Fix for bug 13430, cap inline splitting for continuations to a maximum depth of 200.

Reviewed by olliej, antti

• rendering/RenderInline.cpp: (WebCore::RenderInline::splitInlines):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderInline.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2007-04-23  David Hyatt  <hyatt@apple.com>
+
+        Fix for bug 13430, cap inline splitting for continuations to a maximum depth of 200.
+
+        Reviewed by olliej, antti
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+
 2007-04-23  Alp Toker  <alp@atoker.com>
 

trunk/WebCore/rendering/RenderInline.cpp

@@ -160 +160 @@
     RenderFlow* curr = static_cast<RenderFlow*>(parent());
     RenderFlow* currChild = this;
+    
+    // FIXME: Because splitting is O(n^2) as tags nest pathologically, we cap the depth at which we're willing to clone.
+    // There will eventually be a better approach to this problem that will let us nest to a much
+    // greater depth (see bugzilla bug 13430) but for now we have a limit.  This *will* result in
+    // incorrect rendering, but the alternative is to hang forever.
+    unsigned splitDepth = 1;
+    const unsigned cMaxSplitDepth = 200; 
     while (curr && curr != fromBlock) {
-        // Create a new clone.
-        RenderInline* cloneChild = clone;
-        clone = cloneInline(curr);
-
-        // Insert our child clone as the first child.
-        clone->addChildToFlow(cloneChild, 0);
-
-        // Hook the clone up as a continuation of |curr|.
-        RenderFlow* oldCont = curr->continuation();
-        curr->setContinuation(clone);
-        clone->setContinuation(oldCont);
-
-        // Someone may have indirectly caused a <q> to split.  When this happens, the :after content
-        // has to move into the inline continuation.  Call updatePseudoChild to ensure that the inline's :after
-        // content gets properly destroyed.
-        curr->updatePseudoChild(RenderStyle::AFTER);
-
-        // Now we need to take all of the children starting from the first child
-        // *after* currChild and append them all to the clone.
-        o = currChild->nextSibling();
-        while (o) {
-            RenderObject* tmp = o;
-            o = tmp->nextSibling();
-            clone->addChildToFlow(curr->removeChildNode(tmp), 0);
-            tmp->setNeedsLayoutAndMinMaxRecalc();
+        if (splitDepth < cMaxSplitDepth) {
+            // Create a new clone.
+            RenderInline* cloneChild = clone;
+            clone = cloneInline(curr);
+
+            // Insert our child clone as the first child.
+            clone->addChildToFlow(cloneChild, 0);
+
+            // Hook the clone up as a continuation of |curr|.
+            RenderFlow* oldCont = curr->continuation();
+            curr->setContinuation(clone);
+            clone->setContinuation(oldCont);
+
+            // Someone may have indirectly caused a <q> to split.  When this happens, the :after content
+            // has to move into the inline continuation.  Call updatePseudoChild to ensure that the inline's :after
+            // content gets properly destroyed.
+            curr->updatePseudoChild(RenderStyle::AFTER);
+
+            // Now we need to take all of the children starting from the first child
+            // *after* currChild and append them all to the clone.
+            o = currChild->nextSibling();
+            while (o) {
+                RenderObject* tmp = o;
+                o = tmp->nextSibling();
+                clone->addChildToFlow(curr->removeChildNode(tmp), 0);
+                tmp->setNeedsLayoutAndMinMaxRecalc();
+            }
         }
-
+        
         // Keep walking up the chain.
         currChild = curr;
         curr = static_cast<RenderFlow*>(curr->parent());
+        splitDepth++;
     }